rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-1826 
Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-26T10:00:00.000Z
CVE-2014-1827 
The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-26T10:00:00.000Z
CVE-2014-1828 
The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-26T10:00:00.000Z
CVE-2014-1829 
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-15T14:00:00.000Z
CVE-2014-1830 
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-15T14:00:00.000Z
CVE-2014-1831 
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2014-1832 
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2014-1833 
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T18:00:00.000Z
CVE-2014-1834 
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T21:00:00.000Z
CVE-2014-1835 
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T21:00:00.000Z
CVE-2014-1836 
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-01T14:00:00.000Z
CVE-2014-1837 
Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T19:00:00.000Z
CVE-2014-1838 
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2014-1839 
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2014-1840 
Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2014-1841 
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T10:00:00.000Z
CVE-2014-1842 
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T10:00:00.000Z
CVE-2014-1843 
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T10:00:00.000Z
CVE-2014-1845 
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z
CVE-2014-1846 
Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z
CVE-2014-1849 
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2014-1854 
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-27T15:00:00.000Z
CVE-2014-1855 
Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T14:00:00.000Z
CVE-2014-1858 
__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-1859 
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-1860 
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T15:37:35.000Z
CVE-2014-1861 
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T11:00:00.000Z
CVE-2014-1867 
suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: suphp
product: suphp
Published: 2019-12-13T13:08:00.000Z
CVE-2014-1868 
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2014-1869 
Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-08T00:00:00.000Z
CVE-2014-1870 
Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T23:00:00.000Z
CVE-2014-1874 
The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-28T02:00:00.000Z
CVE-2014-1875 
The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2014-1876 
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T23:00:00.000Z
CVE-2014-1877 
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-13T14:00:00.000Z
CVE-2014-1878 
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-28T15:00:00.000Z
CVE-2014-1879 
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-20T11:00:00.000Z
CVE-2014-1881 
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1882 
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1883 
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1884 
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1885 
The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1886 
The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1887 
The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2014-1888 
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-28T17:00:00.000Z
CVE-2014-1889 
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-1891 
Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1892 
Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1893 
Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1894 
Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1895 
Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1896 
The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2014-1899 
Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T14:00:00.000Z
CVE-2014-1900 
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T00:00:00.000Z
CVE-2014-1901 
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp.  NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T00:00:00.000Z
CVE-2014-1902 
Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T00:00:00.000Z
CVE-2014-1903 
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T11:00:00.000Z
CVE-2014-1904 
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T16:00:00.000Z
CVE-2014-1905 
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-29T20:00:00.000Z
CVE-2014-1906 
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-06T15:00:00.000Z
CVE-2014-1907 
Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-06T15:00:00.000Z