rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-0957 
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-18T01:00:00.000Z
CVE-2014-0958 
Open redirect vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T10:00:00.000Z
CVE-2014-0959 
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote authenticated users to cause a denial of service (infinite loop) via a login redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T10:00:00.000Z
CVE-2014-0960 
IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-14T10:00:00.000Z
CVE-2014-0961 
Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-08T18:00:00.000Z
CVE-2014-0963 
The Reverse Proxy feature in IBM Global Security Kit (aka GSKit) in IBM Security Access Manager (ISAM) for Web 7.0 before 7.0.0-ISS-SAM-IF0006 and 8.0 before 8.0.0.3-ISS-WGA-IF0002 allows remote attackers to cause a denial of service (infinite loop) via crafted SSL messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-0964 
IBM WebSphere Application Server (WAS) 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of service via crafted TLS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T10:00:00.000Z
CVE-2014-0965 
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T01:00:00.000Z
CVE-2014-0966 
SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-17T23:00:00.000Z
CVE-2014-0967 
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T01:00:00.000Z
CVE-2014-0968 
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL for an MHTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T01:00:00.000Z
CVE-2014-0969 
Cross-site request forgery (CSRF) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-17T23:00:00.000Z
CVE-2014-0970 
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject links via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T01:00:00.000Z
CVE-2014-0972 
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write to arbitrary memory locations, by using a crafted GPU command stream to modify the contents of a certain register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-0973 
The image_verify function in platform/msm_shared/image_verify.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, which makes it easier for attackers to bypass boot-image authentication requirements via trailing data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T01:00:00.000Z
CVE-2014-0974 
The boot_linux_from_mmc function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly validate a certain address value, which allows attackers to write data to a controllable memory location by leveraging the ability to initiate an attempted boot of an arbitrary image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T01:00:00.000Z
CVE-2014-0977 
Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T17:00:00.000Z
CVE-2014-0978 
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T17:00:00.000Z
CVE-2014-0979 
The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T01:00:00.000Z
CVE-2014-0980 
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-11T17:00:00.000Z
CVE-2014-0981 
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-28T21:00:00.000Z
CVE-2014-0983 
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-28T21:00:00.000Z
CVE-2014-0984 
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-17T14:00:00.000Z
CVE-2014-0985 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0986 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0987 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0988 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0989 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0990 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0991 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0992 
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-20T10:00:00.000Z
CVE-2014-0993 
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-15T14:00:00.000Z
CVE-2014-0994 
Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows context-dependent attackers to execute arbitrary code via the BITMAPINFOHEADER.biClrUsed field in a BMP file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0993.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-0995 
The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-06T15:00:00.000Z
CVE-2014-0997 
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not properly handle exceptions, which allows remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T19:00:00.000Z
CVE-2014-0998 
Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, which triggers an array index error and out-of-bounds kernel memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T16:00:00.000Z
CVE-2014-0999 
Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2014-100001 
Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100002 
Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100003 
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ym_download_id parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100004 
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100005 
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100006 
Multiple cross-site scripting (XSS) vulnerabilities in modules_v3/googlemap/wt_v3_street_view.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) map, (2) streetview, or (3) reset parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100007 
Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100008 
Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100009 
The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php, (6) phpthumb/GdThumb.inc.php, or (7) phpthumb/thumb_plugins/gd_reflection.inc.php in includes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100010 
Cross-site scripting (XSS) vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T11:00:00.000Z
CVE-2014-100011 
SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100012 
SQL injection vulnerability in /app in Sendy 1.1.8.4 allows remote attackers to execute arbitrary SQL commands via the i parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100013 
Multiple cross-site scripting (XSS) vulnerabilities in clientResponse 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Subject or (2) Message field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100014 
Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a long string in a (1) 2001, (2) 2002, or (3) 2003 opcode to port 3000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100015 
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100016 
Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100017 
Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitrary web script or HTML via the message field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100018 
Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100019 
SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100020 
SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter.  NOTE: the CatID parameter is already covered by CVE-2008-0685.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100021 
Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearch[employee_name][empId] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z
CVE-2014-100022 
SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T15:00:00.000Z