yahoo-inc/cve-impacts huggingface dataset:
CVE-2014-125104: A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.
Key phrases: unrestricted upload
CVE-2014-125105: A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
Key phrases: cross site scripting
CVE-2014-125106: Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.
Key phrases: size_t overflows in pb_dec_bytes and pb_dec_string
CVE-2014-125107: A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The patch is identified as 48fde5ffa4d76014bad260a3cbab7ada3744a4cc. It is recommended to upgrade the affected component. VDB-248270 is the identifier assigned to this vulnerability.
CVE-2014-125108: A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2014-125109: A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.28 is able to address this issue. The name of the patch is d2ede580474665af56ff262a05783fbabe4529b8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248956.
Key phrases: cross site scripting
CVE-2014-1252: Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, double free
CVE-2014-1253: AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file.
Key phrases: denial of service (kernel memory corruption), cause a denial of service (kernel memory, unspecified other impact, malformed header, unspecified impact
CVE-2014-1254: Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2014-1255: Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
Key phrases: bypass the App Sandbox protection, bypass the App Sandbox protection mechanism via crafted
CVE-2014-1256: Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
Key phrases: bypass the App Sandbox protection, bypass the App Sandbox protection mechanism via crafted, buffer overflow
CVE-2014-1257: CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.
Key phrases: bypass intended access restrictions, bypass intended access restrictions by leveraging an unattended, session cookies
CVE-2014-1258: Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, heap-based buffer overflow, heap based buffer overflow
CVE-2014-1259: Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, buffer overflow
CVE-2014-1260: QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1261: Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, integer signedness error
CVE-2014-1262: Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.
Key phrases: bypass the App Sandbox protection, bypass the App Sandbox protection mechanism via crafted, memory corruption
CVE-2014-1263: curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
Key phrases: spoof servers via an arbitrary valid certificate, man in the middle, spoofing
CVE-2014-1264: Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL.
Key phrases: bypass intended access restrictions, bypass intended access restrictions in opportunistic circumstances via, damaged acl, integrity
CVE-2014-1265: The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.
Key phrases: bypass intended access restrictions, bypass intended access restrictions by changing the current
CVE-2014-1266: The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Key phrases: spoof SSL servers by (1) using, omitting the signing step, man in the middle, spoofing
CVE-2014-1267: The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
Key phrases: bypass intended access restrictions, bypass intended access restrictions by using a profile
CVE-2014-1268: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1269: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1270: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1271: CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.
Key phrases: denial of service (assertion failure and device crash), cause a denial of service (assertion failure
CVE-2014-1272: CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink.
Key phrases: change arbitrary file permissions, change arbitrary file permissions by leveraging a symlink
CVE-2014-1273: dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.
Key phrases: bypass code-signing requirements, bypass code-signing requirements by leveraging use, text-relocation instructions
CVE-2014-1274: FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.
Key phrases: obtain sensitive FaceTime contact, obtain sensitive FaceTime contact information by using the, invalid facetime call
CVE-2014-1275: Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, buffer overflow
CVE-2014-1276: IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.
Key phrases: conduct user-action monitoring attacks against arbitrary, iokit hid event
CVE-2014-1278: The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call.
Key phrases: denial of service (out-of-bounds memory access and device crash), gain privileges, gain privileges or cause a denial of service, out of bounds memory
CVE-2014-1279: Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data.
Key phrases: obtain sensitive information, obtain sensitive information by reading log data
CVE-2014-1280: Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding.
Key phrases: denial of service (NULL pointer dereference and device hang), cause a denial of service (NULL pointer, null pointer dereference
CVE-2014-1281: Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
Key phrases: obtain sensitive photo data, obtain sensitive photo data by launching the Photos
CVE-2014-1282: The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.
Key phrases: bypass intended configuration-profile visibility requirements, bypass intended configuration-profile visibility requirements via
CVE-2014-1285: Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.
Key phrases: bypass intended access restrictions, bypass intended access restrictions and read the home, application crash
CVE-2014-1286: SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.
Key phrases: denial of service (lock-screen hang), cause a denial of service (lock-, state-management error
CVE-2014-1287: USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, usb host
CVE-2014-1289: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1290: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1291: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1292: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1293: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1294: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1295: Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
Key phrases: obtain sensitive information, obtain sensitive information or modify TLS session data, triple handshake, man in the middle
CVE-2014-1296: CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
Key phrases: bypass intended access restrictions, bypass intended access restrictions by triggering the closing
CVE-2014-1297: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.
Key phrases: read arbitrary files, bypass a sandbox protection, bypass a sandbox protection mechanism and read arbitrary, webprocess ipc messages, webprocess access, bypass sandbox
CVE-2014-1298: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1299: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1300: Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges via unknown, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1301: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1302: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1303: Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.
Key phrases: execute arbitrary code, bypass a sandbox protection, execute arbitrary code and bypass a sandbox protection, heap-based buffer overflow, unspecified vectors, heap based buffer overflow, bypass sandbox
CVE-2014-1304: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1305: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1307: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1308: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1309: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1310: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1311: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1312: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1313: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1314: WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
Key phrases: execute arbitrary code, bypass the sandbox protection, bypass the sandbox protection mechanism and execute arbitrary, session creation, bypass sandbox
CVE-2014-1315: Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, format string
CVE-2014-1316: Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.
Key phrases: denial of service (abort and daemon exit), cause a denial of service (abort and, heimdal
CVE-2014-1317: iBooks Commerce in Apple OS X before 10.9.4 places Apple ID credentials in the iBooks log, which allows local users to obtain sensitive information by reading this file.
Key phrases: obtain sensitive information, obtain sensitive information by reading this file, local users
CVE-2014-1318: The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted application, pointer
CVE-2014-1319: Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, buffer overflow
CVE-2014-1320: IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object.
Key phrases: bypass the ASLR protection, iokit, bypass aslr, unspecified
CVE-2014-1321: Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action.
Key phrases: bypass an intended transition into the locked-screen state
CVE-2014-1322: The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object.
Key phrases: bypass the ASLR protection, unspecified attribute, bypass aslr
CVE-2014-1323: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1324: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1325: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1326: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1327: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1329: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1330: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1331: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1333: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1334: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1335: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1336: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1337: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1338: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1339: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1340: WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1341: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1342: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1343: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1344: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1345: WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which allows remote attackers to spoof the address bar via a crafted web site.
Key phrases: spoof the address bar via a crafted web, spoofing
CVE-2014-1346: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.
Key phrases: bypass intended restrictions, spoof a postMessage origin, postmessage origin, spoofing
CVE-2014-1347: Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations.
Key phrases: obtain access, modify files, world-writable permissions, reboot
CVE-2014-1348: Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/, which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.
Key phrases: obtain sensitive information, cleartext attachments, availability
CVE-2014-1349: Use-after-free vulnerability in Safari in Apple iOS before 7.1.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an invalid URL.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1350: Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iCloud password requirement, and turn off the Find My iPhone service, by leveraging incorrect state management.
Key phrases: bypass an intended iCloud password requirement, incorrect state management
CVE-2014-1351: Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-screen passcode requirement, and read a contact list, via a Siri request that refers to a contact ambiguously.
Key phrases: bypass an intended lock-screen, bypass an intended lock-screen passcode requirement
CVE-2014-1352: Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempts, which makes it easier for physically proximate attackers to conduct brute-force passcode-guessing attacks via unspecified vectors.
Key phrases: brute-force passcode-guessing, unspecified vectors
CVE-2014-1353: Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, which allows physically proximate attackers to bypass the lock protection mechanism, and access a certain foreground application, via unspecified vectors.
Key phrases: bypass the lock protection, bypass the lock protection mechanism, unspecified vectors
CVE-2014-1354: CoreGraphics in Apple iOS before 7.1.2 does not properly restrict allocation of stack memory for processing of XBM images, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image data.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of
CVE-2014-1355: The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in IOReporting in Apple OS X before 10.9.4, allows local users to cause a denial of service (NULL pointer dereference and reboot) via crafted API arguments.
Key phrases: denial of service (NULL pointer dereference and reboot), cause a denial of service (NULL pointer, null pointer dereference
CVE-2014-1356: Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that sends IPC messages.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted application that, heap-based buffer overflow, heap based buffer overflow
CVE-2014-1357: Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that generates log messages.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted application that, heap-based buffer overflow, heap based buffer overflow
CVE-2014-1358: Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted application, integer overflow
CVE-2014-1359: Integer underflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted application, integer underflow
CVE-2014-1360: Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors.
Key phrases: bypass the Activation Lock protection, unspecified vectors
CVE-2014-1361: Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DTLS message within a TLS connection.
Key phrases: obtain potentially sensitive information, obtain potentially sensitive information from uninitialized process memory
CVE-2014-1362: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1363: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1364: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1365: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1366: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1367: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1368: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2014-1369: WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site.
Key phrases: access file: URLs by leveraging a URL, file: urls, url drag operation
CVE-2014-1370: The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.
Key phrases: execute arbitrary code, denial of service (out-of-bounds memory access and application crash), execute arbitrary code or cause a denial of, byte-swapping implementation, out of bounds memory