rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-5424 
Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-14T00:00:00.000Z
CVE-2014-5425 
IOServer before Beta2112.exe allows remote attackers to cause a denial of service (out-of-bounds read and master entry consumption) via a null DNP3 header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5426 
MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-27T15:00:00.000Z
CVE-2014-5427 
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read password hashes via a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2014-5428 
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to execute arbitrary code by uploading a shell script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2014-5429 
DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service (CPU consumption) via malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-06T15:00:00.000Z
CVE-2014-5430 
Untrusted search path vulnerability in ABB RobotStudio 5.6x before 5.61.02 and Test Signal Viewer 1.5 allows local users to gain privileges via a Trojan horse DLL that is accessed as a result of incorrect DLL configuration by an optional installation program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-5431 
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provides access to basic biomedical information, limited device settings, and network configuration of the WBM, if connected. The hard-coded password may allow an attacker with physical access to the device to access management functions to make unauthorized configuration changes to biomedical settings such as turn on and off wireless connections and the phase-complete audible alarm that indicates the end of an infusion phase. Baxter has released a new version of the SIGMA Spectrum Infusion System, version 8, which incorporates hardware and software changes.
Problem types: cwe_id: CWE-259
description: Hard-coded password CWE-259
Affected products: vendor: Baxter
product: SIGMA Spectrum Infusion System
Published: 2019-03-26T15:37:49.000Z
CVE-2014-5432 
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH without authentication. A remote attacker may be able to make unauthorized configuration changes to the WBM, as well as issue commands to access account credentials and shared keys. Baxter asserts that this vulnerability only allows access to features and functionality on the WBM and that the SIGMA Spectrum infusion pump cannot be controlled from the WBM. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes.
Problem types: cwe_id: CWE-592
description: Authentication bypass issues CWE-592
Affected products: vendor: Baxter
product: SIGMA Spectrum Infusion System
Published: 2019-03-26T15:17:16.000Z
CVE-2014-5433 
An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16, which may allow an attacker to gain access the host network. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes.
Problem types: cwe_id: CWE-312
description: Cleartext storage of sensitive information CWE-312
Affected products: vendor: Baxter
product: SIGMA Spectrum Infusion System
Published: 2019-03-26T15:07:39.000Z
CVE-2014-5434 
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credentials used with the FTP protocol. Baxter asserts no files can be transferred to or from the WBM using this account. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes.
Problem types: cwe_id: CWE-259
description: Hard-coded password CWE-259
Affected products: vendor: Baxter
product: SIGMA Spectrum Infusion System
Published: 2019-03-26T14:59:52.000Z
CVE-2014-5435 
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Problem types: cwe_id: CWE-123
description: Arbitrary memory write CWE-123
Affected products: vendor: Honeywell
product: Experion PKS
Published: 2019-04-08T15:25:17.000Z
CVE-2014-5436 
A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Problem types: cwe_id: CWE-22
description: Directory traversal CWE-22
Affected products: vendor: Honeywell
product: Experion PKS
Published: 2019-04-08T15:18:41.000Z
CVE-2014-5437 
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T18:00:00.000Z
CVE-2014-5438 
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T18:00:00.000Z
CVE-2014-5439 
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-19T15:05:09.000Z
CVE-2014-5440 
SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-12T14:00:00.000Z
CVE-2014-5441 
Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-12T14:00:00.000Z
CVE-2014-5443 
Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-5444 
Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-30T14:00:00.000Z
CVE-2014-5445 
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-04T17:00:00.000Z
CVE-2014-5446 
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-04T17:00:00.000Z
CVE-2014-5447 
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2014-5448 
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2014-5449 
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2014-5450 
Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-5451 
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/.  NOTE: this issue exists because of a CVE-2014-2080 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-06T18:00:00.000Z
CVE-2014-5452 
CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T10:00:00.000Z
CVE-2014-5453 
Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory (%PROGRAMFILES%\Ubisoft Game Launcher), which allows local users to gain privileges via a Trojan horse file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5454 
Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5455 
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5456 
Cross-site scripting (XSS) vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "[Content Type]: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5457 
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5458 
SQL injection vulnerability in sqrl_verify.php in php-sqrl allows remote attackers to execute arbitrary SQL commands via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5459 
The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-27T10:00:00.000Z
CVE-2014-5460 
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T15:00:00.000Z
CVE-2014-5461 
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T00:00:00.000Z
CVE-2014-5462 
Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interface/billing/sl_eob_search.php; (9) sortby parameter to interface/logview/logview.php; form_facility parameter to (10) procedure_stats.php, (11) pending_followup.php, or (12) pending_orders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patient_file/deleter.php; (17) search_term parameter to interface/patient_file/encounter/coding_popup.php; (18) text parameter to interface/patient_file/encounter/search_code.php; (19) form_addr1, (20) form_addr2, (21) form_attn, (22) form_country, (23) form_freeb_type, (24) form_partner, (25) form_name, (26) form_zip, (27) form_state, (28) form_city, or (29) form_cms_id parameter to interface/practice/ins_search.php; (30) form_pid parameter to interface/patient_file/problem_encounter.php; (31) patient, (32) form_provider, (33) form_apptstatus, or (34) form_facility parameter to interface/reports/appointments_report.php; (35) db_id parameter to interface/patient_file/summary/demographics_save.php; (36) p parameter to interface/fax/fax_dispatch_newpid.php; or (37) patient_id parameter to interface/patient_file/reminder/patient_reminders.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T16:00:00.000Z
CVE-2014-5464 
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-08T14:00:00.000Z
CVE-2014-5465 
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-03T19:00:00.000Z
CVE-2014-5466 
Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2014-5468 
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T16:04:28.000Z
CVE-2014-5470 
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2014-5471 
Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-01T01:00:00.000Z
CVE-2014-5472 
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-01T01:00:00.000Z
CVE-2014-5500 
Synacor Zimbra Collaboration before 8.0.8 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T18:25:32.000Z
CVE-2014-5501 
Stack-based buffer overflow in the diagnose service in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary code via a crafted webpage or file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T14:00:00.000Z
CVE-2014-5502 
The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a (1) checkcert_key, (2) webclient_portal_settings, (3) sslvpn_liveuser_delete, or (4) ccc_flush_sql_file opcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T14:00:00.000Z
CVE-2014-5503 
SQL injection vulnerability in the Guest Login Portal in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary SQL commands via the add_guest_user opcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T14:00:00.000Z
CVE-2014-5504 
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T17:00:00.000Z
CVE-2014-5505 
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T17:00:00.000Z
CVE-2014-5506 
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T17:00:00.000Z
CVE-2014-5507 
iBackup 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib_service.exe, which allows local users to gain privileges via a Trojan horse file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-03T16:00:00.000Z
CVE-2014-5508 
Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service (infinite loop) via a large value in the EmptyInterval parameter or certain other interval configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-05T14:00:00.000Z
CVE-2014-5509 
clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-5516 
Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T19:57:49.000Z
CVE-2014-5519 
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T14:00:00.000Z