rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-5275 
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T16:00:00.000Z
CVE-2014-5276 
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via (1) an uploaded profile picture or (2) the edit parameter to profiles/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T16:00:00.000Z
CVE-2014-5277 
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T16:00:00.000Z
CVE-2014-5278 
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T17:03:36.000Z
CVE-2014-5279 
The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attackers to gain privileges or execute arbitrary code from children containers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T16:00:00.000Z
CVE-2014-5280 
boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without TLS authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T16:00:00.000Z
CVE-2014-5282 
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T16:00:00.000Z
CVE-2014-5284 
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T01:00:00.000Z
CVE-2014-5285 
Unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x before 6.0.3, and 6.5.x before 6.5.1 allows remote attackers to gain privileges, and obtain sensitive information or modify data, via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T10:00:00.000Z
CVE-2014-5286 
The ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x before 3.1.2, ActiveMatrix Policy Manager 3.x before 3.1.2, ActiveMatrix Management Agent 1.x before 1.2.1 for WCF, and ActiveMatrix Management Agent 1.x before 1.2.1 for WebSphere allows remote attackers to gain privileges and obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T02:00:00.000Z
CVE-2014-5287 
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:36:22.000Z
CVE-2014-5288 
A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T16:46:27.000Z
CVE-2014-5289 
Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T20:35:52.000Z
CVE-2014-5297 
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-5298 
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-5300 
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, impersonate arbitrary users, and execute commands via a message without a signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T19:00:00.000Z
CVE-2014-5301 
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2014-5302 
Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2014-5307 
Heap-based buffer overflow in the PavTPK.sys kernel mode driver of Panda Security 2014 products before hft131306s24_r1 allows local users to gain privileges via a crafted argument to a 0x222008 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-26T14:00:00.000Z
CVE-2014-5308 
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T17:00:00.000Z
CVE-2014-5313 
Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-10T10:00:00.000Z
CVE-2014-5314 
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T02:00:00.000Z
CVE-2014-5315 
Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T10:00:00.000Z
CVE-2014-5316 
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T01:00:00.000Z
CVE-2014-5317 
Cross-site scripting (XSS) vulnerability in php365.com 365 Links 3.11 and earlier, 365 Links2 3.11 and earlier, 365 Links+ 2.10 and earlier, and 365 Links2+ 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-18T10:00:00.000Z
CVE-2014-5318 
The jigbrowser+ application 1.8.1 and earlier for iOS allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T10:00:00.000Z
CVE-2014-5319 
Directory traversal vulnerability in the S-Link SLFileManager application 1.2.5 and earlier for Android allows remote attackers to write to files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T10:00:00.000Z
CVE-2014-5320 
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T01:00:00.000Z
CVE-2014-5321 
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T01:00:00.000Z
CVE-2014-5322 
Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T01:00:00.000Z
CVE-2014-5323 
The Yuko Yuko (aka jp.co.yukoyuko.android.yukoyuko_android) application 1.0.5 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-24T00:00:00.000Z
CVE-2014-5324 
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T10:00:00.000Z
CVE-2014-5325 
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T02:00:00.000Z
CVE-2014-5326 
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T02:00:00.000Z
CVE-2014-5327 
Buffer overflow in the Webserver component on the Huawei E5332 router before 21.344.27.00.1080 allows remote authenticated users to cause a denial of service (reboot) via a long URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-12T01:00:00.000Z
CVE-2014-5328 
Buffer overflow in the Webserver component on the Huawei E5332 router before 21.344.27.00.1080 allows remote authenticated users to cause a denial of service (reboot) via a long parameter in an API service request message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-12T01:00:00.000Z
CVE-2014-5329 
GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative operation.
8001/tcp is served by a version of Apache HTTP server containing a flaw in handling HTTP requests (CVE-2011-3192), which may lead to a denial-of-service (DoS) condition.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: TripodWorks CO.,LTD.
product: GIGAPOD OFFICEHARD Appliance model
vendor: TripodWorks CO.,LTD.
product: GIGAPOD 2010 / GIGAPOD 3 Appliance model
vendor: TripodWorks CO.,LTD.
product: GIGAPOD 2010 / GIGAPOD 3 Software model
Published: 2023-09-08T02:52:41.251Z
CVE-2014-5330 
Cross-site scripting (XSS) vulnerability in BirdBlog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5331 
Cross-site scripting (XSS) vulnerability in Aflax allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5332 
Race condition in NVMap in NVIDIA Tegra Linux Kernel 3.10 allows local users to gain privileges via a crafted NVMAP_IOC_CREATE IOCTL call, which triggers a use-after-free error, as demonstrated by using a race condition to escape the Chrome sandbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T11:00:00.000Z
CVE-2014-5333 
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T10:00:00.000Z
CVE-2014-5334 
FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-5335 
Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by (1) changing the administrator password via a crafted request to CMD0/mod_cmd.xml or (2) adding a new SIP user via a crafted request to PBX0/ADMIN/mod_cmd_login.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T16:00:00.000Z
CVE-2014-5336 
Monkey HTTP Server before 1.5.3, when the File Descriptor Table (FDT) is enabled and custom error messages are set, allows remote attackers to cause a denial of service (file descriptor consumption) via an HTTP request that triggers an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-26T14:00:00.000Z
CVE-2014-5337 
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T14:00:00.000Z
CVE-2014-5338 
Multiple cross-site scripting (XSS) vulnerabilities in the multisite component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) render_status_icons function in htmllib.py or (2) ajax_action function in actions.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5339 
Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write check_mk config files (.mk files) to arbitrary locations via vectors related to row selections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T14:00:00.000Z
CVE-2014-5340 
The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T14:00:00.000Z
CVE-2014-5341 
The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-04T18:00:00.000Z
CVE-2014-5342 
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-6627.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-19T18:00:00.000Z
CVE-2014-5343 
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-5344 
Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-5345 
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5346 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to wp-admin/edit-comments.php, (3) import comments via an import_comments action, or (4) export comments via an export_comments action to wp-admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5347 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5348 
Cross-site scripting (XSS) vulnerability in apps/zxtm/locallog.cgi in Riverbed Stingray (aka SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel 9620140312 allows remote attackers to inject arbitrary web script or HTML via the logfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5349 
Stack-based buffer overflow in Baidu Spark Browser 26.5.9999.3511 allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print JavaScript function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5350 
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T19:00:00.000Z
CVE-2014-5351 
The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-5352 
The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T11:00:00.000Z
CVE-2014-5353 
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T23:00:00.000Z
CVE-2014-5354 
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T23:00:00.000Z
CVE-2014-5355 
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-20T11:00:00.000Z