rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-0762 CG Automation ePAQ-9410 Substation Gateway Improper Input Validation
The CG Automation Software DNP3 driver, used in the ePAQ-9410 Substation
 Gateway products, does not validate input correctly. An attacker could 
cause the software to go into an infinite loop, causing the process to 
crash. The system must be restarted manually to clear the condition.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: CG Automation
product: ePAQ-9410 Substation Gateway
default_status: unaffected
Credits: lang: en
value: Adam Crain of Automatak
lang: en
value: Chris Sistrunk of Mandiant
Published: 2014-08-28T01:00:00.000Z
CVE-2014-0763 Advantech WebAccess SQL Injection
An attacker using SQL injection may use arguments to construct queries 
without proper sanitization. The DBVisitor.dll is exposed through SOAP 
interfaces, and the exposed functions are vulnerable to SOAP injection. 
This may allow unexpected SQL action and access to records in the table 
of the software database or execution of arbitrary code.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0764 Advantech WebAccess Stack-based Buffer Overflow
By providing an overly long string to the NodeName parameter, an 
attacker may be able to overflow the static stack buffer. The attacker 
may then execute code on the target device remotely.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0765 Advantech WebAccess Stack-based Buffer Overflow
To exploit this vulnerability, the attacker sends data from the GotoCmd 
argument to control. If the value of the argument is overly long, the 
static stack buffer can be overflowed. This will allow the attacker to 
execute arbitrary code remotely.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0766 Advantech WebAccess Stack-based Buffer Overflow
An attacker can exploit this vulnerability by copying an overly long 
NodeName2 argument into a statically sized buffer on the stack to 
overflow the static stack buffer. An attacker may use this vulnerability
 to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0767 Advantech WebAccess Stack-based Buffer Overflow
An attacker may exploit this vulnerability by passing an overly long 
value from the AccessCode argument to the control. This will overflow 
the static stack buffer. The attacker may then execute code on the 
target device remotely.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0768 Advantech WebAccess Stack-based Buffer Overflow
An attacker may pass an overly long value from the AccessCode2 argument 
to the control to overflow the static stack buffer. The attacker may 
then remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0769 Festo CECX-X-(C1/M1) Controller Improper Authentication
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Festo
product: CECX-X-C1 Modular Master Controller with CoDeSys
default_status: unaffected
vendor: Festo
product: CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
default_status: unaffected
Credits: lang: en
value: K. Reid Wightman of IOActive, Inc. has identified vulnerabilities in Festo’s CECX-X-C1 and CECX-X-M1 controllers.
Published: 2014-04-25T01:00:00.000Z
CVE-2014-0770 Advantech WebAccess Stack-based Buffer Overflow
By providing an overly long string to the UserName parameter, an 
attacker may be able to overflow the static stack buffer. The attacker 
may then execute code on the target device remotely.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0771 Advantech WebAccess File and Directory Information Exposure
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
“OpenUrlToBuffer.” This method takes a URL as a parameter and returns 
its contents to the caller in JavaScript. The URLs are accessed in the 
security context of the current browser session. The control does not 
perform any URL validation and allows “file://” URLs that access the 
local disk.


The method can be used to open a URL (including file URLs) and read 
file URLs through JavaScript. This method could also be used to reach 
any arbitrary URL to which the browser has access.
Problem types: cwe_id: CWE-538
description: CWE-538
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0772 Advantech WebAccess File and Directory Information Exposure
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
OpenUrlToBufferTimeout. This method takes a URL as a parameter and 
returns its contents to the caller in JavaScript. The URLs are accessed 
in the security context of the current browser session. The control does
 not perform any URL validation and allows file:// URLs that access the 
local disk.


The method can be used to open a URL (including file URLs) and read 
the URLs through JavaScript. This method could also be used to reach any
 arbitrary URL to which the browser has access.
Problem types: cwe_id: CWE-538
description: CWE-538
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0773 Advantech WebAccess Command Injection
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
“CreateProcess.” This method contains validation to ensure an attacker 
cannot run arbitrary command lines. After validation, the values 
supplied in the HTML are passed to the Windows CreateProcessA API.


The validation can be bypassed allowing for running arbitrary command
 lines. The command line can specify running remote files (example: UNC 
command line).


A function exists at offset 100019B0 of bwocxrun.ocx. Inside this 
function, there are 3 calls to strstr to check the contents of the user 
specified command line. If “\setup.exe,” “\bwvbprt.exe,” or 
“\bwvbprtl.exe” are contained in the command line (strstr returns 
nonzero value), the command line passes validation and is then passed to
 CreateProcessA.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: Advantech
product: WebAccess
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0774 Schneider Electric OFS Stack Buffer Overflow
Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Schneider Electric
product: TLXCDSUOFS33
default_status: unaffected
vendor: Schneider Electric
product: TLXCDSTOFS33
default_status: unaffected
vendor: Schneider Electric
product: TLXCDLUOFS33
default_status: unaffected
vendor: Schneider Electric
product: TLXCDLTOFS33
default_status: unaffected
vendor: Schneider Electric
product: TLXCDLFOFS33
default_status: unaffected
Credits: lang: en
value: Schneider Electric
Published: 2014-02-28T02:00:00.000Z
CVE-2014-0777 OServer Out of Bounds Read
The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: IOServer
product: OPC Drivers
default_status: unaffected
Credits: lang: en
value: Chris Sistrunk of Mandiant and Adam Crain of Automatak
Published: 2014-04-11T16:00:00.000Z
CVE-2014-0778 Progea Movicon SCADA Exposure of Sensitive Information to an Unauthorized Actor
TCPUploader module listens on Port 10651/TCP for incoming connections. 
Exploitation of this vulnerability could allow a remote unauthenticated 
user access to release OS version information. While this is a minor 
vulnerability, it represents a method for further network 
reconnaissance.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Progea
product: Movicon
default_status: unaffected
Credits: lang: en
value: Celil Ünüver of SignalSEC Ltd.
Published: 2014-04-19T19:00:00.000Z
CVE-2014-0779 Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory Buffer
The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file).
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Schneider Electric
product: ClearSCADA
default_status: unaffected
vendor: Schneider Electric
product: SCADA Expert ClearSCADA
default_status: unaffected
Credits: lang: en
value: Andrew Brooks identified and reported to The Zero Day Initiative (ZDI)
Published: 2014-03-14T10:00:00.000Z
CVE-2014-0780 InduSoft Web Studio Path Traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: InduSoft
product: Web Studio
default_status: unaffected
Credits: lang: en
value: Zero Day Initiative (ZDI)
Published: 2014-04-25T01:00:00.000Z
CVE-2014-0781 Yokogawa CENTUM CS 3000 Heap-based Buffer Overflow
Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Yokogawa
product: CENTUM CS 3000
default_status: unaffected
Credits: lang: en
value: Juan Vazquez of Rapid7 Inc.
Published: 2014-03-14T10:00:00.000Z
CVE-2014-0782 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Yokogawa
product: CENTUM CS 3000
default_status: unaffected
Credits: lang: en
value: Juan Vazquez of Rapid7 Inc.
Published: 2014-05-16T10:00:00.000Z
CVE-2014-0783 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow
Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Yokogawa
product: CENTUM CS 3000
default_status: unaffected
Credits: lang: en
value: Juan Vazquez of Rapid7 Inc.
Published: 2014-03-14T10:00:00.000Z
CVE-2014-0784 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow
Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Yokogawa
product: CENTUM CS 3000
default_status: unaffected
Credits: lang: en
value: Juan Vazquez of Rapid7 Inc.
Published: 2014-03-14T10:00:00.000Z
CVE-2014-0786 Ecava IntegraXor Information Exposure
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Ecava
product: IntegraXor
default_status: unaffected
Credits: lang: en
value: Andrea Micalizzi
Published: 2014-05-01T01:00:00.000Z
CVE-2014-0787 WellinTech KingSCADA Stack-based Buffer Overflow
Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: WellinTech
product: KingSCADA
default_status: unaffected
Credits: lang: en
value: HP’s Zero Day Initiative
Published: 2014-04-12T01:00:00.000Z
CVE-2014-0789 Schneider Electric OPC Factory Server Buffer Overflow
Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Schneider Electric
product: OPC Factory Server (OFS)
default_status: unaffected
Credits: lang: en
value: Wei Gao, formerly of IXIA
Published: 2014-04-04T15:00:00.000Z
CVE-2014-0791 
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-03T17:00:00.000Z
CVE-2014-0792 
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-17T16:00:00.000Z
CVE-2014-0793 
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T18:00:00.000Z
CVE-2014-0794 
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T20:00:00.000Z
CVE-2014-0802 
Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-12T15:00:00.000Z
CVE-2014-0803 
Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-12T15:00:00.000Z
CVE-2014-0804 
Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-12T15:00:00.000Z
CVE-2014-0805 
Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-12T15:00:00.000Z
CVE-2014-0806 
The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T21:00:00.000Z
CVE-2014-0807 
data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T21:00:00.000Z
CVE-2014-0808 
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
Problem types: description: Authorization Bypass Through User-Controlled Key
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE
vendor: S‑cubism Inc.
product: EC-Orange
Published: 2014-01-22T21:00:00.000Z
CVE-2014-0809 
Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T15:00:00.000Z
CVE-2014-0810 
Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T02:00:00.000Z
CVE-2014-0811 
Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2014-0812 
Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-01T15:00:00.000Z
CVE-2014-0813 
Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T16:00:00.000Z
CVE-2014-0814 
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T16:00:00.000Z
CVE-2014-0815 
The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T22:00:00.000Z
CVE-2014-0816 
Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-27T01:00:00.000Z
CVE-2014-0817 
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-27T01:00:00.000Z
CVE-2014-0818 
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2014-0819 
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2014-0820 
Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-27T01:00:00.000Z