rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-0183 
Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Katello
product: Katello
Published: 2020-01-02T19:20:35.000Z
CVE-2014-0184 
Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2014-0185 
sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T10:00:00.000Z
CVE-2014-0186 
A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request.  NOTE: this vulnerability exists because of an unspecified regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-14T10:00:00.000Z
CVE-2014-0187 
The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-28T14:00:00.000Z
CVE-2014-0188 
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-24T14:00:00.000Z
CVE-2014-0189 
virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T14:00:00.000Z
CVE-2014-0190 
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2014-0191 
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T02:00:00.000Z
CVE-2014-0192 
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2014-0193 
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2014-0195 
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T21:00:00.000Z
CVE-2014-0196 
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-07T10:00:00.000Z
CVE-2014-0197 
CFME: CSRF protection vulnerability via permissive check of the referrer header
Problem types: description: CSRF protection vulnerability in referrer header
Affected products: vendor: CFME
product: CFME
Published: 2019-12-13T12:48:28.000Z
CVE-2014-0198 
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T10:00:00.000Z
CVE-2014-0199 
The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-0200 
The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-0201 
ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-0202 
The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T14:00:00.000Z
CVE-2014-0203 
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T10:00:00.000Z
CVE-2014-0204 
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-03T23:00:00.000Z
CVE-2014-0205 
The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T19:00:00.000Z
CVE-2014-0206 
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T10:00:00.000Z
CVE-2014-0207 
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-0208 
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T18:00:00.000Z
CVE-2014-0209 
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2014-0210 
Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2014-0211 
Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2014-0212 
qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors
Problem types: description: ACL policy loading enables a denial of service by consuming all available file descriptors
Affected products: vendor: qpid-cpp
product: qpid-cpp
Published: 2019-12-13T12:55:25.000Z
CVE-2014-0213 
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0214 
login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0215 
The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0216 
The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0217 
enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0218 
Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T00:00:00.000Z
CVE-2014-0219 
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-15T18:00:00.000Z
CVE-2014-0220 
Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2014-0221 
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T21:00:00.000Z
CVE-2014-0222 
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2014-0223 
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2014-0224 
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T21:00:00.000Z
CVE-2014-0225 
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Problem types: description: XXE
Affected products: vendor: Pivotal
product: Spring Framework
Published: 2017-05-25T17:00:00.000Z
CVE-2014-0226 
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-0227 
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-16T00:00:00.000Z
CVE-2014-0228 
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T17:00:00.000Z
CVE-2014-0229 
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2014-0230 
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-07T23:00:00.000Z
CVE-2014-0231 
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-0232 
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-0233 
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T11:00:00.000Z
CVE-2014-0234 
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
Problem types: description: Password
Affected products: vendor: n/a
product: Red Hat OpenShift Enterprise
Published: 2020-02-12T00:09:56.000Z
CVE-2014-0236 
file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2014-0237 
The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-01T01:00:00.000Z
CVE-2014-0238 
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-01T01:00:00.000Z
CVE-2014-0239 
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-28T01:00:00.000Z
CVE-2014-0240 
The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2014-0241 
rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable
Problem types: description: /etc/hammer/cli.modules.d/foreman.yml is world-readable
Affected products: vendor: rubygem-hammer_cli_foreman
product: rubygem-hammer_cli_foreman
Published: 2019-12-13T12:58:21.000Z
CVE-2014-0242 
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
Problem types: description: General Race Condition
Affected products: vendor: mod_wsgi
product: mod_wsgi
Published: 2019-12-09T19:33:29.000Z
CVE-2014-0243 
Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-19T17:00:00.000Z
CVE-2014-0244 
The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T14:00:00.000Z