rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3110 
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-3111 
Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Image Name field to the Image Management page, (3) Storage Group Name field to the Storage Management page, (4) Username field to the User Cleanup FOG Configuration page, or (5) Directory Path field to the Directory Cleaner FOG Configuration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T16:00:00.000Z
CVE-2014-3113 
Multiple buffer overflows in RealNetworks RealPlayer before 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed (1) elst or (2) stsz atom in an MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T10:00:00.000Z
CVE-2014-3114 
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-3115 
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2014-3119 
Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T20:49:59.000Z
CVE-2014-3120 
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T19:00:00.000Z
CVE-2014-3121 
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2014-3122 
The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-11T21:00:00.000Z
CVE-2014-3123 
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2014-3124 
The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-07T10:00:00.000Z
CVE-2014-3125 
Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T14:00:00.000Z
CVE-2014-3127 
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.  NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2014-3129 
The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3130 
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3131 
SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3132 
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3133 
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3134 
Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3135 
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2014-3136 
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T20:14:21.000Z
CVE-2014-3137 
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T22:00:00.000Z
CVE-2014-3138 
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T00:00:00.000Z
CVE-2014-3139 
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T10:00:00.000Z
CVE-2014-3144 
The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-11T21:00:00.000Z
CVE-2014-3145 
The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-11T21:00:00.000Z
CVE-2014-3146 
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2014-3147 
Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-3148 
Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to a non-existent page, which is not properly handled in a 404 error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2014-3149 
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T14:00:00.000Z
CVE-2014-3150 
Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive information via crafted Javascript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-15T18:00:00.000Z
CVE-2014-3152 
Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a negative key value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-21T10:00:00.000Z
CVE-2014-3153 
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-07T14:00:00.000Z
CVE-2014-3154 
Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T10:00:00.000Z
CVE-2014-3155 
net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T10:00:00.000Z
CVE-2014-3156 
Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T10:00:00.000Z
CVE-2014-3157 
Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T10:00:00.000Z
CVE-2014-3158 
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T21:00:00.000Z
CVE-2014-3159 
The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the Omnibox via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-3160 
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-3161 
The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-3162 
Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.125 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-3164 
cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial of service (NULL pointer dereference, or out-of-bounds write) via vectors related to binder passed lengths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T14:00:00.000Z
CVE-2014-3165 
Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an unexpectedly long lifetime of a temporary object during method completion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T01:00:00.000Z
CVE-2014-3166 
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T01:00:00.000Z
CVE-2014-3167 
Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.143 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T01:00:00.000Z
CVE-2014-3168 
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper caching associated with animation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3169 
Use-after-free vulnerability in core/dom/ContainerNode.cpp in the DOM implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3170 
extensions/common/url_pattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '\0' character in a host name, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3171 
Use-after-free vulnerability in the V8 bindings in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper use of HashMap add operations instead of HashMap set operations, related to bindings/core/v8/DOMWrapperMap.h and bindings/core/v8/SerializedScriptValue.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3172 
The Debugger extension API in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 37.0.2062.94 does not validate a tab's URL before an attach operation, which allows remote attackers to bypass intended access limitations via an extension that uses a restricted URL, as demonstrated by a chrome:// URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3173 
The WebGL implementation in Google Chrome before 37.0.2062.94 does not ensure that clear calls interact properly with the state of a draw buffer, which allows remote attackers to cause a denial of service (read of uninitialized memory) via a crafted CANVAS element, related to gpu/command_buffer/service/framebuffer_manager.cc and gpu/command_buffer/service/gles2_cmd_decoder.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3174 
modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service (read of uninitialized memory) via crafted API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3175 
Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors, related to the load_truetype_glyph function in truetype/ttgload.c in FreeType and other functions in other components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3176 
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3177.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3177 
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3176.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-27T01:00:00.000Z
CVE-2014-3178 
Use-after-free vulnerability in core/dom/Node.cpp in Blink, as used in Google Chrome before 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-10T10:00:00.000Z
CVE-2014-3179 
Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.120 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-10T10:00:00.000Z
CVE-2014-3180 
In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable
Problem types: description: out-of-bounds read
Affected products: vendor: Linux
product: kernel
Published: 2019-11-06T19:22:03.000Z