rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3594 
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-3595 
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T15:00:00.000Z
CVE-2014-3596 
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T00:00:00.000Z
CVE-2014-3597 
Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function.  NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-23T01:00:00.000Z
CVE-2014-3598 
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T15:00:00.000Z
CVE-2014-3599 
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
Problem types: description: XXE due to insecure configuration of RestEasy
Affected products: vendor: HornetQ REST
product: HornetQ REST
Published: 2019-11-12T13:27:04.000Z
CVE-2014-3600 
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T19:00:00.000Z
CVE-2014-3601 
The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-01T01:00:00.000Z
CVE-2014-3602 
Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-13T15:00:00.000Z
CVE-2014-3603 
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: Other
Affected products: vendor: Shibboleth; OpenSAML Java
product: Identity Provider (IdP)
vendor: Shibboleth; OpenSAML Java
product: OpenSAML Java
Published: 2019-04-04T13:38:16.000Z
CVE-2014-3604 
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T00:00:00.000Z
CVE-2014-3607 
DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-3608 
The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-3609 
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T18:00:00.000Z
CVE-2014-3610 
The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-3611 
Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-3612 
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-24T14:00:00.000Z
CVE-2014-3613 
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-18T15:00:00.000Z
CVE-2014-3614 
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-19T14:00:00.000Z
CVE-2014-3615 
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-01T23:00:00.000Z
CVE-2014-3616 
nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-3617 
The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q&A forum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-15T14:00:00.000Z
CVE-2014-3618 
Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-08T14:00:00.000Z
CVE-2014-3619 
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2014-3620 
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-18T15:00:00.000Z
CVE-2014-3621 
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-3622 
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
Problem types: description: Other
Affected products: vendor: PHP
product: PHP
Published: 2020-02-19T12:46:23.000Z
CVE-2014-3623 
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-30T14:00:00.000Z
CVE-2014-3624 
Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2014-3625 
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-3626 
The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue, the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable, however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers, in addition to JBoss, on which this vulnerability is exposed.
Problem types: description: Directory Traversal
Affected products: vendor: Dell EMC
product: Grails by Pivotal
Published: 2018-03-19T13:00:00.000Z
CVE-2014-3627 
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T16:00:00.000Z
CVE-2014-3628 
Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-06T15:00:00.000Z
CVE-2014-3629 
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T16:00:00.000Z
CVE-2014-3630 
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T22:00:00.000Z
CVE-2014-3631 
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3632 
The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows remote attackers to gain privileges via a crafted configuration file.  NOTE: this vulnerability exists because of a CVE-2013-6433 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T14:00:00.000Z
CVE-2014-3633 
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-3634 
rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-02T00:00:00.000Z
CVE-2014-3635 
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T15:00:00.000Z
CVE-2014-3636 
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T20:00:00.000Z
CVE-2014-3637 
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T15:00:00.000Z
CVE-2014-3638 
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T15:00:00.000Z
CVE-2014-3639 
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T15:00:00.000Z
CVE-2014-3640 
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T19:00:00.000Z
CVE-2014-3641 
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T19:00:00.000Z
CVE-2014-3642 
vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-3643 
jersey: XXE via parameter entities not disabled by the jersey SAX parser
Problem types: description: XXE via parameter entities
Affected products: vendor: jersey
product: jersey
Published: 2019-12-15T21:12:24.000Z
CVE-2014-3645 
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-3646 
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-3647 
arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-10T11:00:00.000Z
CVE-2014-3648 
The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Jboss Aerogear
Published: 2022-07-01T13:16:16.000Z
CVE-2014-3649 
JBoss AeroGear has reflected XSS via the password field
Problem types: description: reflected XSS via password field of the login page
Affected products: vendor: JBoss
product: AeroGear
Published: 2019-11-04T14:02:24.000Z
CVE-2014-3650 
Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Jboss Aerogear
Published: 2022-07-01T13:17:25.000Z
CVE-2014-3651 
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T15:00:00.000Z
CVE-2014-3652 
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
Problem types: description: Open redirect vulnerability
Affected products: vendor: JBoss KeyCloak
product: JBoss KeyCloak
Published: 2019-12-15T21:16:12.000Z
CVE-2014-3653 
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T14:55:00.000Z