rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-8966 
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-11T00:00:00.000Z
CVE-2014-8967 
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in conjunction with a Cascading Style Sheets (CSS) token sequence specifying the run-in value for the display property, leading to improper CElement reference counting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-15T17:27:00.000Z
CVE-2014-8985 
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2811, CVE-2014-2822, CVE-2014-2823, CVE-2014-4057, and CVE-2014-4145.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2014-8986 
Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-8987 
Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-24T15:00:00.000Z
CVE-2014-8988 
MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-8989 
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-30T01:00:00.000Z
CVE-2014-8990 
default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T16:00:00.000Z
CVE-2014-8991 
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-8992 
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-22T19:00:00.000Z
CVE-2014-8993 
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T18:00:00.000Z
CVE-2014-8994 
The check_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a temporary file with a predictable name (tmp/check_diskio_status-*-*).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T15:00:00.000Z
CVE-2014-8995 
SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-8996 
Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) author_name or (2) content parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-8997 
Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/uploads/images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-8998 
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-8999 
SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands via the selgroups parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9000 
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user.  NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9001 
reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) APPTMIN, (2) APPTHR, (3) APPTDA, (4) APPTMO, (5) APPTYR, or (6) APPTPHONE parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9002 
Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9003 
Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9004 
Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a member_profile action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9005 
Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1) country, (2) gender1, or ((3) gender2 parameter in a search action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9006 
Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to certain values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T11:00:00.000Z
CVE-2014-9013 
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T20:34:16.000Z
CVE-2014-9014 
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T20:34:10.000Z
CVE-2014-9015 
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-9016 
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-9017 
Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-11T14:00:00.000Z
CVE-2014-9018 
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-9019 
Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin user name or (2) conduct cross-site scripting (XSS) attacks via the sysUserName parameter in a save action to adminpasswd.cgi or (3) change the admin user password via the sysPassword parameter in a save action to adminpasswd.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9020 
Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action.  NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected products and codebases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9021 
Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi).  NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9022 
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9023 
The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9024 
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9025 
The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9026 
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9027 
Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem lan ports via the (1) enblftp, (2) enblhttp, (3) enblsnmp, (4) enbltelnet, (5) enbltftp, (6) enblicmp, or (7) enblssh parameter to accesslocal.cmd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-9028 
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9029 
Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T16:00:00.000Z
CVE-2014-9030 
The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-9031 
Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9032 
Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9033 
Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9034 
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9035 
Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9036 
Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9037 
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9038 
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9039 
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T23:00:00.000Z
CVE-2014-9041 
The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9042 
Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol.  NOTE: this can be leveraged by remote attackers using CVE-2014-9041.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9043 
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9044 
Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9045 
The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9046 
The OC_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9047 
Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9048 
The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9049 
The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-9050 
Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2014-9057 
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2014-9059 
lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T11:00:00.000Z
CVE-2014-9060 
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T11:00:00.000Z
CVE-2014-9065 
common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-09T22:52:00.000Z