yahoo-inc/cve-impacts huggingface dataset:
CVE-2014-2553: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via vectors, cross-site scripting (xss)
CVE-2014-2554: OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
Key phrases: conduct clickjacking attacks via an IFRAME element, iframe element
CVE-2014-2558: The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\\\' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a \\\\'
CVE-2014-2559: Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
Key phrases: hijack the authentication of administrators for requests that, cross-site request forgery (csrf), cross site request forgery, unspecified
CVE-2014-2560: The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
Key phrases: obtain access, sip digest leak
CVE-2014-2565: The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection."
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors, command injection
CVE-2014-2567: The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.
Key phrases: trigger use of cleartext for saving a message, man in the middle
CVE-2014-2568: Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.
Key phrases: obtain sensitive information, obtain sensitive information from kernel memory by leveraging, use-after-free
CVE-2014-2570: Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2571: Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2014-2572: mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.
Key phrases: modify grade metadata via unspecified vectors
CVE-2014-2573: The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Key phrases: denial of service (resource consumption), bypass the quota limit and cause a denial
CVE-2014-2575: Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.
Key phrases: write arbitrary files, read or write arbitrary files via a .., directory traversal
CVE-2014-2576: plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Key phrases: spoofing, man in the middle
CVE-2014-2577: Multiple cross-site scripting (XSS) vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the (1) pn parameter to index.fsp/document.pdf, (2) db or (3) referer parameter to index.fsp/index.fsp, or (4) PATH_INFO to the default URI.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2578: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2014-2579: Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php.  NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin.  NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Key phrases: execute arbitrary commands, hijack the authentication of administrators for requests that, cross-site request forgery (csrf), vector, cross site request forgery
CVE-2014-2580: The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.
Key phrases: denial of service ("scheduling while atomic" error and host crash), cause a denial of service ("scheduling, malformed packet
CVE-2014-2581: Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.
Key phrases: obtain credentials, obtain credentials via vectors related to the cuid
CVE-2014-2583: Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.
Key phrases: create arbitrary files, bypass authentication, create arbitrary files or possibly bypass authentication via, directory traversal
CVE-2014-2585: ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.
Key phrases: mount the local filesystem in the user's
CVE-2014-2586: Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2014-2587: SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter).
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the username of, sql injection
CVE-2014-2588: Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2014-2589: Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2590: The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets.
Key phrases: denial of service (interface outage), cause a denial of service (interface outage
CVE-2014-2591: Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting.
Key phrases: gain privileges, gain privileges via a crafted library, untrusted search path
CVE-2014-2592: Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Key phrases: execute arbitrary code, execute arbitrary code by uploading a file with, unrestricted file upload
CVE-2014-2593: The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in certain
CVE-2014-2595: Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
Key phrases: bypass authentication, bypass authentication by leveraging a permanent authentication token
CVE-2014-2597: PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read.
Key phrases: denial of service (disabled keyboard or crash), cause a denial of service (disabled keyboard, large input buffer, unspecified ioctl requests, buffer over-read, buffer over read
CVE-2014-2598: Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin/admin.php.
Key phrases: hijack the authentication of administrators for requests that, cross-site request forgery (csrf), cross site request forgery
CVE-2014-2599: The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, large input
CVE-2014-2600: Unspecified vulnerability in HP IceWall Identity Manager 4.0 through SP1 and 5.0 and IceWall SSO 10.0 Password Reset Option, when Apache Commons FileUpload is used, allows remote authenticated users to cause a denial of service via unknown vectors.
Key phrases: cause a denial of service via unknown vectors, unspecified, password reset option, unspecified vulnerability
CVE-2014-2601: The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.
Key phrases: cause a denial of service via crafted HTTPS
CVE-2014-2602: Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2603: Unspecified vulnerability on HP 8/20q switches, SN6000 switches, and 8Gb Simple SAN Connection Kit with firmware before 8.0.14.08.00 allows remote authenticated users to obtain sensitive information via unknown vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2604: Unspecified vulnerability in HP IceWall SSO 10.0 Dfw and IceWall MCRP 2.1 and 3.0 allows remote attackers to cause a denial of service via unknown vectors.
Key phrases: cause a denial of service via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2605: Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote attackers to obtain sensitive information via unknown vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2606: Unspecified vulnerability in HP StoreVirtual 4000 Storage and StoreVirtual VSA 9.5 through 11.0 allows remote authenticated users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2607: Unspecified vulnerability in HP Operations Manager i 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraging the OMi operator role.
Key phrases: execute arbitrary code, execute arbitrary code by leveraging the OMi operator, unspecified, unspecified vulnerability
CVE-2014-2608: Unspecified vulnerability in HP Smart Update Manager 6.x before 6.4.1 on Windows, and 6.2.x through 6.4.x before 6.4.1 on Linux, allows local users to obtain sensitive information, and consequently gain privileges, via unknown vectors.
Key phrases: obtain sensitive information, gain privileges, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2609: The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116.
Key phrases: execute arbitrary code, execute arbitrary code via a session on TCP, authentication
CVE-2014-2610: Directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file, aka ZDI-CAN-2117.
Key phrases: execute arbitrary code, execute arbitrary code by uploading an executable file, directory traversal
CVE-2014-2611: Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data, via unspecified vectors, aka ZDI-CAN-2120.
Key phrases: execute arbitrary code, obtain sensitive information, directory traversal, delete data, unspecified vectors
CVE-2014-2612: Unspecified vulnerability in HP Release Control 9.x before 9.13 p3 and 9.2x before RC 9.21.0003 p1 on Windows and 9.2x before RC 9.21.0002 p1 on Linux allows remote authenticated users to obtain sensitive information via unknown vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2613: Unspecified vulnerability in HP Release Control 9.x before 9.13 p3 and 9.2x before RC 9.21.0003 p1 on Windows and 9.2x before RC 9.21.0002 p1 on Linux allows remote authenticated users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2614: Unspecified vulnerability in HP SiteScope 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-2140.
Key phrases: bypass authentication, bypass authentication via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2615: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2083.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code or obtain sensitive information via, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2616: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2091.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code or obtain sensitive information via, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2617: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2104.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code or obtain sensitive information via, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2618: Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2080.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2619: Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2088.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2620: Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2089.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2621: Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-2090.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2622: Unspecified vulnerability in HP Intelligent Management Center (iMC) before 7.0 E02020P03 and Branch Intelligent Management System (BIMS) before 7.0 E0201P02 allows remote authenticated users to obtain sensitive information or modify data via unknown vectors, aka ZDI-CAN-2312.
Key phrases: obtain sensitive information, obtain sensitive information or modify data via unknown, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2623: Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2624: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2625: Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.
Key phrases: read arbitrary files, read arbitrary files via crafted input, directory traversal
CVE-2014-2626: Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.
Key phrases: execute arbitrary code, create files, directory traversal
CVE-2014-2627: Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.
Key phrases: gain privileges, gain privileges for NetBatch job execution via unknown, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-2628: Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2629: HP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01 does not properly evaluate the DISKFILE-PATTERN ACL of a program object file, which allows remote authenticated users to bypass intended restrictions on program access via vectors related to process-creation time.
Key phrases: bypass intended restrictions, bypass intended restrictions on program access via vectors
CVE-2014-2630: Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2631: Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2632: Unspecified vulnerability in the WebTier component in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2633: Cross-site request forgery (CSRF) vulnerability in the server in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Key phrases: hijack the authentication of unspecified victims via unknown, cross-site request forgery (csrf), unknown vectors, cross site request forgery
CVE-2014-2634: Unspecified vulnerability in the server in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to bypass intended access restrictions, and modify data or cause a denial of service, via unknown vectors.
Key phrases: bypass intended access restrictions, unspecified, denial of service, unknown vectors, unspecified vulnerability
CVE-2014-2635: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2343.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2636: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2336.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2637: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2342.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2638: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2344.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2639: Unspecified vulnerability in HP MPIO Device Specific Module Manager before 4.02.00 allows local users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2640: Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2014-2641: Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Key phrases: hijack the authentication of unspecified victims via unknown, cross-site request forgery (csrf), unknown vectors, cross site request forgery
CVE-2014-2642: HP System Management Homepage (SMH) before 7.4 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Key phrases: conduct clickjacking attacks via unspecified vectors
CVE-2014-2643: Unspecified vulnerability in HP Systems Insight Manager (SIM) before 7.4 allows remote authenticated users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2644: Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss)
CVE-2014-2645: HP Systems Insight Manager (SIM) before 7.4 allows remote attackers to conduct clickjacking attacks via unknown vectors.
Key phrases: conduct clickjacking attacks via unknown vectors
CVE-2014-2646: Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors.
Key phrases: bypass intended access restrictions, bypass intended access restrictions via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2647: Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 11.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2014-2648: Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2649: Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2650: Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
Key phrases: os command injection
CVE-2014-2651: Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface
Key phrases: bypass in the default mode of the Workpoint Interface, authentication bypass
CVE-2014-2652: SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2014-2653: The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
Key phrases: trigger the skipping of SSHFP DNS RR checking, unacceptable hostcertificate
CVE-2014-2654: Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) edit_ad_unit.php, (2) view_adunits.php, or (3) edit_campaign.php in www/cp/.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2014-2655: SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via a new alias, sql injection
CVE-2014-2657: Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs.
Key phrases: unspecified, unknown impact, remote vectors, unspecified vulnerability
CVE-2014-2658: Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors.
Key phrases: cause a denial of service via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-2659: Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2014-2664: Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Key phrases: execute arbitrary code, execute arbitrary code by uploading a file with, unrestricted file upload, unspecified
CVE-2014-2665: includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
Key phrases: obtain sensitive information, victims activity, login csrf
CVE-2014-2667: Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.
Key phrases: bypass intended file permissions, bypass intended file permissions by leveraging a separate, race condition, application
CVE-2014-2668: Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.
Key phrases: denial of service (CPU and memory consumption), cause a denial of service (CPU and, count parameter
CVE-2014-2669: Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.
Key phrases: have unspecified impact via vectors related to the, integer overflows, buffer overflow
CVE-2014-2670: Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2671: Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file.
Key phrases: denial of service (memory corruption), cause a denial of service (memory corruption, unspecified other impact, unspecified impact
CVE-2014-2672: Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.
Key phrases: denial of service (system crash), cause a denial of service (system crash, race condition, list deletions
CVE-2014-2673: The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.
Key phrases: denial of service (Program Check and system crash), cause a denial of service (Program Check
CVE-2014-2674: Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to wp-admin/admin-ajax.php.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2014-2675: Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php.
Key phrases: hijack the authentication of administrators for requests that, cross-site request forgery (csrf), cross site request forgery
CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
Key phrases: denial of service (NULL pointer dereference and system crash), cause a denial of service (NULL pointer, null pointer dereference, unspecified other impact, unspecified impact
CVE-2014-2680: The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.
Key phrases: execute arbitrary code, execute arbitrary code via a man-in, man-in-the-middle, man in the middle
CVE-2014-2681: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Key phrases: read arbitrary files, denial of service (CPU and memory consumption), xml external entity (xxe)
CVE-2014-2682: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Key phrases: conduct XML External Entity (XXE) attacks, xml external entity (xxe)
CVE-2014-2683: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, circular references
CVE-2014-2684: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
Key phrases: bypass authentication, bypass authentication and spoof arbitrary OpenID identities by, spoofing
CVE-2014-2685: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Key phrases: bypass authentication, bypass authentication by leveraging an assertion from an
CVE-2014-2686: Ansible prior to 1.5.4 mishandles the evaluation of some strings.
CVE-2014-2689: Cross-site scripting (XSS) vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to installer/index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2690: Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log.
Key phrases: obtain administrator credentials, obtain administrator credentials by reading the log
CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.
Key phrases: denial of service (system crash), cause a denial of service (system crash, race condition
CVE-2014-2707: cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2014-2708: Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection
CVE-2014-2709: lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in unspecified
CVE-2014-2710: Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the (1) login page (index.php) or (2) login form (loginform-inc.php).
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2711: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2014-2712: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2014-2713: Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 13.3 before 13.3R1, as used in MX Series and T4000 routers, allows remote attackers to cause a denial of service (PFE restart) via a crafted IP packet to certain (1) Trio or (2) Cassis-based Packet Forwarding Engine (PFE) modules.
Key phrases: denial of service (PFE restart), cause a denial of service (PFE restart
CVE-2014-2714: The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL.
Key phrases: denial of service (flow daemon crash and restart), cause a denial of service (flow daemon
CVE-2014-2715: Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\\\\templates\\\\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-2716: Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.
Key phrases: obtain plaintext messages via an XOR operation on, xor operation
CVE-2014-2717: Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
Key phrases: bypass authentication, obtain administrative access, bypass authentication and obtain administrative access by visiting, change-password page
CVE-2014-2718: ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image, integrity, man in the middle
CVE-2014-2719: Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code.
Key phrases: obtain the administrator user name and password, obtain the administrator user name and password by, administrator session
CVE-2014-2720: IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a ZIP archive's local file header, which allows user-assisted remote attackers to conduct file-extension spoofing attacks via a modified Central Directory, as demonstrated by unintended code execution prompted by a .jpg extension in the Central Directory and a .exe extension in the local file header.
Key phrases: conduct file-extension spoofing attacks via a, unintended code execution
CVE-2014-2721: In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect.
Key phrases: gain privileged, gain privileged access to affected systems using SSH, platform-specific remote access, configuration error
CVE-2014-2722: In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect.
Key phrases: gain privileged, gain privileged access to affected systems using SSH, platform-specific remote access, configuration error