rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-9686 
The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service via the 'url' parameter to plugin_googlemap3_kmlprxy.php.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7428.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T19:00:00.000Z
CVE-2014-9687 
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T14:00:00.000Z
CVE-2014-9688 
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T16:00:00.000Z
CVE-2014-9689 
content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope data, which makes it easier for remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for ondeviceorientation events, a different vulnerability than CVE-2015-1231.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2014-9690 
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator (RNG) used in the supplier's solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN, the attacker can access the Internet via the cracked device.
Problem types: description: WPS PIN Offline Brute Force Crack
Affected products: vendor: n/a
product: WS318 V100R001C01B022 and earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2014-9695 
The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier versions could allow a non-super-domain user who accesses HMM through SNMPv3 to perform operations on a server as a super-domain user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Tecal E9000 Chassis V100R001C00SPC160 and earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2014-9696 
The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier versions allows the operator to modify the user configuration of iMana through privilege escalation.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Tecal E9000 Chassis V100R001C00SPC160 and earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2014-9697 
Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, reboot and MPU switchover) via a crafted website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T14:00:00.000Z
CVE-2014-9699 
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers through this HTTP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T20:42:29.000Z
CVE-2014-9701 
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T18:00:00.000Z
CVE-2014-9702 
system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T16:56:02.000Z
CVE-2014-9705 
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2014-9706 
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T14:00:00.000Z
CVE-2014-9707 
EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T14:00:00.000Z
CVE-2014-9708 
Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T00:00:00.000Z
CVE-2014-9709 
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2014-9710 
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-27T10:00:00.000Z
CVE-2014-9711 
Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-25T14:00:00.000Z
CVE-2014-9712 
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2014-9713 
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2014-9714 
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-13T14:00:00.000Z
CVE-2014-9715 
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-27T10:00:00.000Z
CVE-2014-9716 
Cross-site scripting (XSS) vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-08T14:00:00.000Z
CVE-2014-9717 
fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2014-9718 
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-21T16:00:00.000Z
CVE-2014-9720 
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T17:03:38.000Z
CVE-2014-9721 
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-03T20:00:00.000Z
CVE-2014-9727 
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-29T15:00:00.000Z
CVE-2014-9728 
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2014-9729 
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2014-9730 
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2014-9731 
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2014-9732 
The cabd_extract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-11T14:00:00.000Z
CVE-2014-9733 
nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T14:00:00.000Z
CVE-2014-9734 
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2014-9735 
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2014-9736 
GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2014-9737 
Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T14:55:00.000Z
CVE-2014-9738 
Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T14:55:00.000Z
CVE-2014-9739 
Cross-site scripting (XSS) vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T14:55:00.000Z
CVE-2014-9740 
Cross-site scripting (XSS) vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the (1) question and (2) description strings in a confirmation form for a triggering Rules link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T14:55:00.000Z
CVE-2014-9741 
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T15:00:00.000Z
CVE-2014-9742 
The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T14:00:00.000Z
CVE-2014-9743 
Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-17T15:00:00.000Z
CVE-2014-9744 
Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages.  NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-24T15:00:00.000Z
CVE-2014-9745 
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-14T20:00:00.000Z
CVE-2014-9746 
The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2014-9747 
The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2014-9748 
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-11T16:54:57.000Z
CVE-2014-9749 
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-06T21:00:00.000Z
CVE-2014-9750 
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-04T20:00:00.000Z
CVE-2014-9751 
The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-04T20:00:00.000Z
CVE-2014-9752 
Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the file in content/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-16T19:00:00.000Z
CVE-2014-9753 
confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-11T17:51:14.000Z
CVE-2014-9754 
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T15:00:00.000Z
CVE-2014-9755 
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T15:00:00.000Z
CVE-2014-9756 
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-19T20:00:00.000Z
CVE-2014-9757 
The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-08T19:00:00.000Z
CVE-2014-9758 
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T18:00:00.000Z
CVE-2014-9759 
Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T21:00:00.000Z
CVE-2014-9760 
Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z