rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3469 
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z
CVE-2014-3470 
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T21:00:00.000Z
CVE-2014-3471 
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T17:00:00.000Z
CVE-2014-3472 
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3473 
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T15:00:00.000Z
CVE-2014-3474 
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T15:00:00.000Z
CVE-2014-3475 
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T15:00:00.000Z
CVE-2014-3476 
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-3477 
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T17:00:00.000Z
CVE-2014-3478 
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-3479 
The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-3480 
The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-3481 
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2014-3482 
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T10:00:00.000Z
CVE-2014-3483 
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T10:00:00.000Z
CVE-2014-3484 
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.
Problem types: description: Buffer Overflow
Affected products: vendor: n/a
product: musl libc
Published: 2020-02-20T03:37:59.000Z
CVE-2014-3485 
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T14:00:00.000Z
CVE-2014-3486 
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2014-3487 
The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-3488 
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-3489 
lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2014-3490 
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3491 
Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T16:00:00.000Z
CVE-2014-3492 
Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T16:00:00.000Z
CVE-2014-3493 
The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T14:00:00.000Z
CVE-2014-3494 
kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T16:00:00.000Z
CVE-2014-3495 
duplicity 0.6.24 has improper verification of SSL certificates
Problem types: description: verification of SSL certificates
Affected products: vendor: duplicity
product: duplicity
Published: 2019-12-13T13:20:46.000Z
CVE-2014-3496 
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-20T14:00:00.000Z
CVE-2014-3497 
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-03T17:00:00.000Z
CVE-2014-3498 
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T18:00:00.000Z
CVE-2014-3499 
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T14:00:00.000Z
CVE-2014-3500 
Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T21:00:00.000Z
CVE-2014-3501 
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T21:00:00.000Z
CVE-2014-3502 
Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T21:00:00.000Z
CVE-2014-3503 
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T14:00:00.000Z
CVE-2014-3504 
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3505 
Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3506 
d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3507 
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3508 
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3509 
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3510 
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3511 
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3512 
Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-3513 
Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-3514 
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-20T10:00:00.000Z
CVE-2014-3515 
The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-09T10:00:00.000Z
CVE-2014-3517 
api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-3518 
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T20:00:00.000Z
CVE-2014-3519 
The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local container users with CAP_DAC_READ_SEARCH capability to bypass an intended container protection mechanism and access arbitrary files on a filesystem via vectors related to use of the file_handle structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2014-3520 
OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-26T20:00:00.000Z
CVE-2014-3521 
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-3522 
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3523 
Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-3524 
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-26T14:00:00.000Z
CVE-2014-3525 
Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-3526 
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2014-3527 
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.
Problem types: description: Access Control Bypass
Affected products: vendor: Pivotal
product: Spring Security
Published: 2017-05-25T17:00:00.000Z
CVE-2014-3528 
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3529 
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T17:00:00.000Z