rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-8669 
The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-06T15:00:00.000Z
CVE-2014-8670 
Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-06T15:00:00.000Z
CVE-2014-8671 
Cross-site scripting (XSS) vulnerability in the GWT Mobile PhoneGap Showcase application for Android allows remote attackers to inject arbitrary web script or HTML via a crafted Bluetooth Device Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-8672 
Cross-site scripting (XSS) vulnerability in the RewardingYourself application for Android and BlackBerry OS allows remote attackers to inject arbitrary web script or HTML via a crafted QR code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-8673 
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-07T17:27:23.000Z
CVE-2014-8674 
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T21:40:51.000Z
CVE-2014-8675 
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T22:00:00.000Z
CVE-2014-8676 
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T22:00:00.000Z
CVE-2014-8677 
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T22:00:00.000Z
CVE-2014-8678 
The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T15:00:00.000Z
CVE-2014-8680 
The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-11T02:00:00.000Z
CVE-2014-8681 
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T15:00:00.000Z
CVE-2014-8682 
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T15:00:00.000Z
CVE-2014-8683 
Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T15:00:00.000Z
CVE-2014-8684 
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T19:00:00.000Z
CVE-2014-8686 
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T19:00:00.000Z
CVE-2014-8687 
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2014-8688 
An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T09:02:00.000Z
CVE-2014-8690 
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) "First Name" or (4) "Last Name" field to users/edituser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2014-8701 
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8702 
Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8703 
Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8704 
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8705 
PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8706 
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8707 
Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8708 
Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8709 
The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-8710 
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-23T02:00:00.000Z
CVE-2014-8711 
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-23T02:00:00.000Z
CVE-2014-8712 
The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-23T02:00:00.000Z
CVE-2014-8713 
Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-23T02:00:00.000Z
CVE-2014-8714 
The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-23T02:00:00.000Z
CVE-2014-8716 
The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T19:00:00.000Z
CVE-2014-8722 
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8723 
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2014-8724 
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-8727 
Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T16:00:00.000Z
CVE-2014-8728 
SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ranger_user[name] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-8730 
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).  NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T00:00:00.000Z
CVE-2014-8731 
PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T17:00:00.000Z
CVE-2014-8732 
Cross-site scripting (XSS) vulnerability in phpMemcachedAdmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T16:00:00.000Z
CVE-2014-8733 
Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T19:00:00.000Z
CVE-2014-8734 
The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-12T16:00:00.000Z
CVE-2014-8735 
The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-12T16:00:00.000Z
CVE-2014-8736 
The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-12T16:00:00.000Z
CVE-2014-8737 
Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-09T22:52:00.000Z
CVE-2014-8738 
The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8739 
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T17:21:54.000Z
CVE-2014-8741 
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T17:29:28.000Z
CVE-2014-8742 
Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T17:29:25.000Z
CVE-2014-8743 
Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8744 
Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8745 
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8746 
Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8747 
Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8748 
Cross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-13T18:00:00.000Z
CVE-2014-8749 
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2014-8750 
Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-15T14:00:00.000Z
CVE-2014-8751 
Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitrary web script or HTML via the (1) search_param parameter to search.php or (2) name, (3) address, or (4) comment parameter to forms.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2014-8752 
Multiple cross-site scripting (XSS) vulnerabilities in view.php in JCE-Tech PHP Video Script (aka Video Niche Script) 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) video or (2) title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T21:00:00.000Z
CVE-2014-8753 
Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2014-8754 
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-8755 
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-17T15:00:00.000Z
CVE-2014-8756 
The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-17T15:00:00.000Z
CVE-2014-8757 
LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-17T15:00:00.000Z