rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-4843 
Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2014-4844 
The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to bypass intended access restrictions via a project action for a (1) process application or (2) toolkit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T00:00:00.000Z
CVE-2014-4845 
Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T14:00:00.000Z
CVE-2014-4846 
Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T14:00:00.000Z
CVE-2014-4847 
Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4848 
Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4849 
Multiple cross-site scripting (XSS) vulnerabilities in msg.php in FoeCMS allow remote attackers to inject arbitrary web script or HTML via the (1) e or (2) r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4850 
SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4851 
Open redirect vulnerability in msg.php in FoeCMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4852 
SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4853 
Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4854 
Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4855 
Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4856 
Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T16:00:00.000Z
CVE-2014-4857 
Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-26T15:00:00.000Z
CVE-2014-4858 
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-26T10:00:00.000Z
CVE-2014-4859 
Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.
Problem types: description: Integer Overflow
Affected products: vendor: Phoenix Technologies Ltd.
product: SCT3
vendor: American Megatrends Incorporated (AMI)
product: BIOS
Published: 2020-01-31T15:08:20.000Z
CVE-2014-4860 
Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.
Problem types: description: Other
Affected products: vendor: Phoenix Technologies Ltd.
product: SCT3
vendor: American Megatrends Incorporated (AMI)
product: BIOS
Published: 2020-01-31T15:08:16.000Z
CVE-2014-4861 
The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-09T20:00:00.000Z
CVE-2014-4862 
The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remote attackers to obtain sensitive credential, key, and SSID information via an SNMP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-05T17:00:00.000Z
CVE-2014-4863 
The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sensitive password, key, and SSID information via an SNMP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-05T17:00:00.000Z
CVE-2014-4864 
The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-10T10:00:00.000Z
CVE-2014-4865 
Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attackers to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-10T18:00:00.000Z
CVE-2014-4867 
Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-4868 
The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T10:00:00.000Z
CVE-2014-4869 
The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveraging membership in the operator group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T10:00:00.000Z
CVE-2014-4870 
/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges by leveraging the sudo configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T10:00:00.000Z
CVE-2014-4871 
Cross-site scripting (XSS) vulnerability in wlsecurity.html on NetCommWireless NB604N routers with firmware before GAN5.CZ56T-B-NC.AU-R4B030.EN allows remote attackers to inject arbitrary web script or HTML via the wlWpaPsk parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T10:00:00.000Z
CVE-2014-4872 
BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-4873 
SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-4874 
BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-4875 
CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-24T10:00:00.000Z
CVE-2014-4876 
Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment variables via a crafted request to TCP port 54138.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-31T02:00:00.000Z
CVE-2014-4877 
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-29T10:00:00.000Z
CVE-2014-4880 
Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-4881 
The PartyTrack library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-16T19:00:00.000Z
CVE-2014-4882 
Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-23T16:00:00.000Z
CVE-2014-4883 
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T02:00:00.000Z
CVE-2014-4884 
The Conrad Hotel (aka com.wConradHotel) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4885 
The CPWORLD Close Protection World (aka com.tapatalk.closeprotectionworldcom) application 3.4.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4887 
The Joint Radio Blues (aka com.nobexinc.wls_69685189.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4888 
The BattleFriends at Sea GOLD (aka com.tequilamobile.warshipslivegold) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4889 
The Diabetic Diet Guide (aka com.wDiabeticDietGuide) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4890 
The Nano Digest (aka com.magzter.nanodigest) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4891 
The CT iHub (aka com.concursive.ctihub) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4892 
The uControl Smart Home Automation (aka de.ucontrol) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4894 
The MyMetro (aka com.myrippleapps.mymetro) application 2.4.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4895 
The Herpin Time Radio (aka com.herpin.time.radio) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4896 
The Parque Imperial (aka com.a792139893520606f84b2188a.a23428594a) application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4897 
The Touriosity Travelmag (aka com.magzter.touriositytravelmag) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4898 
The Harivijay (aka com.upasanhar.marathi.harivijay) application 4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4899 
The Indian Cement Review (aka com.magzter.indiancementreview) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4900 
The migme (aka com.projectgoth) application 4.03.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4901 
The Bond Trading (aka com.appmakr.app613309) application 197705 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4903 
The Kakao Bingo Garden (aka com.mocoga.bingogarden) application 1.0.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4904 
The Crossmo Calendar (aka com.crossmo.calendar) application 1.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4905 
The Clean Internet Browser (aka com.cleantab.browsesecure) application 1.36 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4906 
The Brisbane & Queensland Alert (aka com.queensland.alert) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T10:00:00.000Z
CVE-2014-4907 
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T10:00:00.000Z
CVE-2014-4908 
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T10:00:00.000Z
CVE-2014-4909 
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-4910 
Directory traversal vulnerability in tools/backlight_helper.c in X.Org xf86-video-intel 2.99.911 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the interface name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4911 
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-4912 
An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T04:00:00.000Z
CVE-2014-4913 
ZF2014-03 has a potential cross site scripting vector in multiple view helpers
Problem types: description: Potential XSS vector in multiple view helpers
Affected products: vendor: zendframework
product: zendframework
Published: 2019-12-15T21:24:36.000Z
CVE-2014-4914 
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T14:00:00.000Z
CVE-2014-4919 
OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign users to arbitrary dynamical user groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-19T15:00:00.000Z
CVE-2014-4925 
Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z