rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-8758 
Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T14:00:00.000Z
CVE-2014-8760 
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T00:00:00.000Z
CVE-2014-8761 
inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-8762 
The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-8763 
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-8764 
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-8765 
Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-14T14:00:00.000Z
CVE-2014-8766 
Multiple SQL injection vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in a browse action to index.php or (2) unspecified parameters to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-14T14:00:00.000Z
CVE-2014-8767 
Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-8768 
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-8769 
tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-20T17:00:00.000Z
CVE-2014-8770 
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-13T15:00:00.000Z
CVE-2014-8771 
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-8772 
Cross-site scripting (XSS) vulnerability in the search_controller in X3 CMS 0.5.1 and 0.5.1.1 allows remote authenticated users to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-8773 
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-8774 
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-8775 
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T18:00:00.000Z
CVE-2014-8778 
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-16T18:00:00.000Z
CVE-2014-8779 
Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and Conferencing Nodes by leveraging these keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2014-8780 
Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T15:00:00.000Z
CVE-2014-8788 
GleamTech FileVista before 6.1 allows remote authenticated users to obtain sensitive information via a crafted path when saving a zip file, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-8789 
GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive, which is not properly handled during extraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-8790 
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-20T15:00:00.000Z
CVE-2014-8791 
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T01:00:00.000Z
CVE-2014-8793 
Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refresh_page parameter to www/admin/report-generate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-8799 
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T15:00:00.000Z
CVE-2014-8800 
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-8801 
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T15:00:00.000Z
CVE-2014-8802 
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2014-8809 
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php, (2) compose_text parameter in a sendMail action to ajax/mail_functions.php, (3) comment parameter in an add_comment action to ajax/lounge_functions.php, or (4) name parameter in a create_album action to ajax/gallery_functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-8810 
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-8816 
CoreGraphics in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8817 
coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8819 
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8820 and CVE-2014-8821.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8820 
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8819 and CVE-2014-8821.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8821 
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8819 and CVE-2014-8820.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8822 
IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8823 
The IOUSBControllerUserClient::ReadRegister function in the IOUSB controller in IOUSBFamily in Apple OS X before 10.10.2 allows local users to read data from arbitrary kernel-memory locations by leveraging root access and providing a crafted first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8824 
The kernel in Apple OS X before 10.10.2 does not properly validate IODataQueue object metadata fields, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8825 
The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, which allows local users to gain privileges or spoof directory-service responses via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8826 
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypass the Gatekeeper protection mechanism via a crafted JAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8827 
LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately upon being woken from sleep, which allows physically proximate attackers to obtain sensitive information by reading the screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8828 
Sandbox in Apple OS X before 10.10 allows attackers to write to the sandbox-profile cache via a sandboxed app that includes a com.apple.sandbox segment in a path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8829 
SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8830 
Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted accessor element in a Collada file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8831 
security_taskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a (1) self-signed certificate or (2) Developer ID certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8832 
The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive, which allows local users to obtain sensitive information by reading from this drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8833 
SpotlightIndex in Apple OS X before 10.10.2 does not properly perform deserialization during access to a permission cache, which allows local users to read search results associated with other users' protected files via a Spotlight query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8834 
UserAccountUpdater in Apple OS X 10.10 before 10.10.2 stores a PDF document's password in a printing preference file, which allows local users to obtain sensitive information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8835 
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8836 
The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8837 
Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8838 
The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates, which allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate for signing a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8839 
Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e-mail message and logging HTTP requests for this image's URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8840 
The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-8866 
The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2014-8867 
The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor, which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2014-8868 
EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain the administrator username and password, and possibly other sensitive information, via a request to /4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-07T21:00:00.000Z
CVE-2014-8869 
Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) app_android_id or (2) app_kindle_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8870 
Open redirect vulnerability in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin before 1.1.2 for Woltlab Burning Board 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the board_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8871 
Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2014-8872 
Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T20:00:00.000Z
CVE-2014-8873 
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-09T16:00:00.000Z
CVE-2014-8874 
The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain sensitive information via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-8875 
The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-8877 
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T18:00:00.000Z
CVE-2014-8878 
KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T17:00:00.000Z