rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-4613 
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-16T17:00:00.000Z
CVE-2014-4614 
Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T20:00:00.000Z
CVE-2014-4615 
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-4616 
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2014-4617 
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T10:00:00.000Z
CVE-2014-4618 
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-20T10:00:00.000Z
CVE-2014-4619 
EMC RSA Identity Management and Governance (IMG) 6.5.x before 6.5.1 P11, 6.5.2 before P02HF01, and 6.8.x before 6.8.1 P07, when Novell Identity Manager (aka NovellIM) is used, allows remote attackers to bypass authentication via an arbitrary valid username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-28T01:00:00.000Z
CVE-2014-4620 
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T10:00:00.000Z
CVE-2014-4621 
EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types, which allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-17T10:00:00.000Z
CVE-2014-4622 
EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data access and server actions, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-17T10:00:00.000Z
CVE-2014-4623 
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T10:00:00.000Z
CVE-2014-4624 
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T10:00:00.000Z
CVE-2014-4626 
EMC Documentum Content Server before 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users to gain privileges by (1) placing a command in a dm_job object and setting this object's owner to a privileged user or placing a rename action in a dm_job_request object and waiting for a (2) dm_UserRename or (3) dm_GroupRename service task, aka ESA-2014-105.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2515.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T01:00:00.000Z
CVE-2014-4627 
SQL injection vulnerability in EMC RSA Web Threat Detection 4.x before 4.6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-4628 
Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-12T18:00:00.000Z
CVE-2014-4629 
EMC Documentum Content Server 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allows remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-06T15:00:00.000Z
CVE-2014-4630 
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.6 and RSA BSAFE SSL-J before 6.1.4 do not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-30T15:00:00.000Z
CVE-2014-4631 
RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone (Authentify) functionality, conducts permanent device binding even when authentication fails, which allows remote attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-4632 
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-01T02:00:00.000Z
CVE-2014-4633 
Cross-site scripting (XSS) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-12T18:00:00.000Z
CVE-2014-4634 
Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-30T15:00:00.000Z
CVE-2014-4635 
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T02:00:00.000Z
CVE-2014-4636 
Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T02:00:00.000Z
CVE-2014-4637 
Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T02:00:00.000Z
CVE-2014-4638 
EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T02:00:00.000Z
CVE-2014-4639 
EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T02:00:00.000Z
CVE-2014-4643 
Multiple heap-based buffer overflows in the client in Core FTP LE 2.2 build 1798 allow remote FTP servers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in a reply to a (1) USER, (2) PASS, (3) PASV, (4) SYST, (5) PWD, or (6) CDUP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T20:00:00.000Z
CVE-2014-4644 
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T20:00:00.000Z
CVE-2014-4645 
Cross-site scripting (XSS) vulnerability in dhcpinfo.html in D-link DSL-2760U-E1 allows remote attackers to inject arbitrary web script or HTML via a hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T20:00:00.000Z
CVE-2014-4646 
Buffer overflow in the FPDFBookmark_GetTitle method in Foxit PDF SDK DLL before 3.1.1.5005 allows context-dependent attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2014-4647 
Stack-based buffer overflow in the loadExtensionFactory method in the TSVisualization ActiveX control in Embarcadero ER/Studio Data Architect allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-4648 
Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-28T15:00:00.000Z
CVE-2014-4649 
SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-28T15:00:00.000Z
CVE-2014-4650 
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T16:01:22.000Z
CVE-2014-4651 
It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, cause a denial of service, or perform other attacks.
Problem types: description: Insecure Temporary File
Affected products: vendor: Apache
product: Apache jclouds
Published: 2020-02-18T13:06:18.000Z
CVE-2014-4652 
Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4653 
sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4654 
The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4655 
The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4656 
Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4657 
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:28:16.000Z
CVE-2014-4658 
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:30:49.000Z
CVE-2014-4659 
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:33:25.000Z
CVE-2014-4660 
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T02:08:50.000Z
CVE-2014-4661 
Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-4663 
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4664 
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-06T15:00:00.000Z
CVE-2014-4667 
The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T01:00:00.000Z
CVE-2014-4668 
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T01:00:00.000Z
CVE-2014-4669 
HP Enterprise Maps 1.00 allows remote authenticated users to read arbitrary files via a WSDL document containing an XML external entity declaration in conjunction with an entity reference within a GetQuote operation, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-28T15:00:00.000Z
CVE-2014-4670 
Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-10T10:00:00.000Z
CVE-2014-4671 
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T01:00:00.000Z
CVE-2014-4672 
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T17:00:00.000Z
CVE-2014-4677 
The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-22T16:00:00.000Z
CVE-2014-4678 
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
Problem types: description: Other
Affected products: vendor: n/a
product: Ansible
Published: 2020-02-20T02:49:50.000Z
CVE-2014-4682 
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4683 
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a (1) HTTP or (2) HTTPS request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4684 
The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4685 
Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4686 
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4687 
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the servicestatusfilter parameter to services_status.widget.php, (4) the txtRecallBuffer parameter to exec.php, or (5) the HTTP Referer header to log.widget.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T10:00:00.000Z
CVE-2014-4688 
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T10:00:00.000Z
CVE-2014-4689 
Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T10:00:00.000Z