rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3969 
Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z
CVE-2014-3970 
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-3971 
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-25T11:00:00.000Z
CVE-2014-3972 
Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2014-3973 
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T17:00:00.000Z
CVE-2014-3974 
Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the viewdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T17:00:00.000Z
CVE-2014-3975 
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T17:00:00.000Z
CVE-2014-3976 
Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long session id in the URI to sys_reboot.html.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T17:00:00.000Z
CVE-2014-3977 
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-08T23:00:00.000Z
CVE-2014-3978 
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T16:00:00.000Z
CVE-2014-3979 
Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the IP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T18:00:03.000Z
CVE-2014-3980 
libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-3981 
acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-08T18:00:00.000Z
CVE-2014-3982 
include/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.##### file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-08T18:00:00.000Z
CVE-2014-3984 
Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-06T14:00:00.000Z
CVE-2014-3985 
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T18:00:00.000Z
CVE-2014-3986 
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-08T18:00:00.000Z
CVE-2014-3988 
Cross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) file or (2) directory (folder) name of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T01:00:00.000Z
CVE-2014-3990 
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T21:00:00.000Z
CVE-2014-3991 
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu parameter to index.php; the (8) dol_use_jmobile, (9) dol_optimize_smallscreen, (10) dol_no_mouse_hover, (11) dol_hide_topmenu, or (12) dol_hide_leftmenu parameter to user/index.php; the (13) dol_use_jmobile, (14) dol_optimize_smallscreen, (15) dol_no_mouse_hover, (16) dol_hide_topmenu, or (17) dol_hide_leftmenu parameter to user/logout.php; the (18) email, (19) firstname, (20) job, (21) lastname, or (22) login parameter in an update action in a "User Card" to user/fiche.php; or the (23) modulepart or (24) file parameter to viewimage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T14:00:00.000Z
CVE-2014-3992 
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T14:00:00.000Z
CVE-2014-3994 
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-16T18:00:00.000Z
CVE-2014-3995 
Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-16T18:00:00.000Z
CVE-2014-3996 
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-3997 
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-3999 
The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-4000 
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-15T16:00:00.000Z
CVE-2014-4002 
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T14:00:00.000Z
CVE-2014-4003 
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4004 
The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4005 
SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4006 
The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4007 
The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4008 
SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4009 
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4010 
SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4011 
SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4012 
SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T20:00:00.000Z
CVE-2014-4013 
SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-14T14:00:00.000Z
CVE-2014-4014 
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T10:00:00.000Z
CVE-2014-4017 
Cross-site scripting (XSS) vulnerability in the Conversion Ninja plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2014-4018 
The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-16T14:00:00.000Z
CVE-2014-4019 
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T17:27:39.000Z
CVE-2014-4020 
The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-18T16:00:00.000Z
CVE-2014-4021 
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-18T19:00:00.000Z
CVE-2014-4022 
The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T14:00:00.000Z
CVE-2014-4023 
Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM, APM, ASM, GTM, and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4, AAM 11.4.0 before 11.6.0, AFM and PEM 11.3.0 before 11.6.0, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4, and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-28T14:00:00.000Z
CVE-2014-4024 
SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-4027 
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T10:00:00.000Z
CVE-2014-4030 
Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-25T20:00:00.000Z
CVE-2014-4031 
The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4032 
Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the Nama field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4033 
Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary web script or HTML via the surname parameter to student.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4034 
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4035 
Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4036 
Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4037 
Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a different issue than CVE-2012-4000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2014-4038 
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T15:00:00.000Z
CVE-2014-4039 
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T15:00:00.000Z
CVE-2014-4040 
snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T15:00:00.000Z
CVE-2014-4043 
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2014-4044 
OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via unspecified vectors related to TMAY requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-4045 
The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-4046 
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-4047 
Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-4048 
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z