yahoo-inc/cve-impacts huggingface dataset:
CVE-2014-1531: Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1532: Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free, vectors related to host resolution
CVE-2014-1533: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1534: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1536: The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
Key phrases: execute arbitrary code, denial of service (out-of-bounds read), execute arbitrary code or cause a denial of, unspecified vectors, out of bounds read
CVE-2014-1537: Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free, unspecified vectors
CVE-2014-1538: Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free, unspecified vectors
CVE-2014-1539: Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image.
Key phrases: visibility of the cursor, clickjacking
CVE-2014-1540: Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1541: Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1542: Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.
Key phrases: execute arbitrary code, execute arbitrary code via vectors related to a, buffer overflow
CVE-2014-1543: Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.
Key phrases: execute arbitrary code, execute arbitrary code by using non-contiguous, heap-based buffer overflows, non-contiguous axes, heap based buffer overflow
CVE-2014-1544: Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.
Key phrases: execute arbitrary code, execute arbitrary code via vectors that trigger certain, use-after-free
CVE-2014-1545: Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
Key phrases: execute arbitrary code, denial of service (out-of-bounds write), execute arbitrary code or cause a denial of, out of bounds write
CVE-2014-1546: The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set.
Key phrases: obtain sensitive information, conduct cross-site request forgery (CSRF, long callback values, cross-site request forgery (csrf), cross site request forgery
CVE-2014-1547: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1548: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1549: The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering.
Key phrases: execute arbitrary code, denial of service (buffer overflow and application crash), execute arbitrary code or cause a denial of
CVE-2014-1550: Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1551: Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.
Key phrases: execute arbitrary code, execute arbitrary code via crafted use of fonts, use-after-free
CVE-2014-1552: Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect.
Key phrases: bypass intended restrictions, bypass intended restrictions on same-origin content
CVE-2014-1553: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1554: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1555: Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.
Key phrases: execute arbitrary code, execute arbitrary code via vectors that trigger a, use-after-free
CVE-2014-1556: Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.
Key phrases: execute arbitrary code, execute arbitrary code via crafted WebGL content constructed
CVE-2014-1557: The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
Key phrases: execute arbitrary code, execute arbitrary code by triggering prolonged image scaling
CVE-2014-1558: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559.
Key phrases: denial of service (X.509 certificate parsing outage), cause a denial of service (X.509 certificate
CVE-2014-1559: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558.
Key phrases: denial of service (X.509 certificate parsing outage), cause a denial of service (X.509 certificate
CVE-2014-1560: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context.
Key phrases: denial of service (X.509 certificate parsing outage), cause a denial of service (X.509 certificate
CVE-2014-1561: Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.
Key phrases: alter the placement of UI icons via crafted, drag-and-drop events, spoofing
CVE-2014-1562: Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1563: Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, use-after-free
CVE-2014-1564: Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.
Key phrases: obtain sensitive information, obtain sensitive information from process memory via crafted
CVE-2014-1565: The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.
Key phrases: denial of service (out-of-bounds read), obtain sensitive information, obtain sensitive information from process memory or cause, out of bounds read
CVE-2014-1566: Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.
Key phrases: obtain sensitive information, obtain sensitive information from the Firefox profile directory
CVE-2014-1567: Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
Key phrases: execute arbitrary code, execute arbitrary code via text that is improperly, use-after-free
CVE-2014-1568: Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
Key phrases: signature malleability, spoofing
CVE-2014-1569: The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
Key phrases: conduct data-smuggling attacks by using a, arbitrary-length encoding
CVE-2014-1571: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
Key phrases: obtain sensitive private-comment information, obtain sensitive private-comment information by leveraging, flag recipient
CVE-2014-1572: The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.
Key phrases: create accounts with unverified e-mail addresses, scalar context
CVE-2014-1573: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
Key phrases: conduct cross-site scripting (XSS), scalar context, cross-site scripting (xss)
CVE-2014-1574: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1575: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, unknown other vectors, unspecified, unspecified vulnerability
CVE-2014-1576: Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
Key phrases: execute arbitrary code, execute arbitrary code via Cascading Style Sheets (, heap-based buffer overflow, cascading style sheets (css) token sequences, changes to capitalization style, heap based buffer overflow
CVE-2014-1577: The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.
Key phrases: denial of service (out-of-bounds read, memory corruption, and application crash), obtain sensitive information, obtain sensitive information from process memory or cause, out of bounds read
CVE-2014-1578: The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
Key phrases: execute arbitrary code, denial of service (out-of-bounds write and application crash), cause a denial of service (out-, invalid tile sizes, out of bounds write
CVE-2014-1580: Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.
Key phrases: obtain sensitive information, obtain sensitive information from process memory via a
CVE-2014-1581: Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
Key phrases: execute arbitrary code, execute arbitrary code via text that is improperly, use-after-free
CVE-2014-1582: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
Key phrases: bypass an intended pinning configuration and spoof a web site, man in the middle, spoofing
CVE-2014-1583: The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
Key phrases: bypass the Same Origin Policy, bypass the Same Origin Policy via crafted API, sensitive information, access sensitive information
CVE-2014-1584: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
Key phrases: bypass an intended pinning configuration and spoof a web site, issuer-verification error, unspecified, spoofing
CVE-2014-1585: The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.
Key phrases: obtain sensitive information, obtain sensitive information from the local camera by
CVE-2014-1586: content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.
Key phrases: obtain sensitive information, obtain sensitive information from the local camera in
CVE-2014-1587: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1588: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), cause a denial of service (memory corruption, multiple unspecified, unknown vectors, unspecified vulnerability
CVE-2014-1589: Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.
Key phrases: bypass intended access restrictions, bypass intended access restrictions via an XBL binding, incorrect primary namespace, xbl binding
CVE-2014-1590: The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2014-1591: Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.
Key phrases: obtain sensitive information, obtain sensitive information via a web site that, path strings, csp violation reports
CVE-2014-1592: Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
Key phrases: execute arbitrary code, execute arbitrary code by adding a second root, use-after-free
CVE-2014-1593: Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
Key phrases: execute arbitrary code, execute arbitrary code via crafted media content, stack-based buffer overflow, stack based buffer overflow
CVE-2014-1594: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
Key phrases: execute arbitrary code, execute arbitrary code by leveraging an incorrect cast
CVE-2014-1595: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
Key phrases: obtain sensitive information, obtain sensitive information by reading /tmp files
CVE-2014-1597: SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the objID parameter, sql injection
CVE-2014-1598: centurystar 7.12 ActiveX Control has a Stack Buffer Overflow
Key phrases: stack buffer overflow
CVE-2014-1599: Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2014-1603: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1604: The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
Key phrases: spoof cache data by pre-creating a, predictable name, spoofing
CVE-2014-1607: Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific.  If so, then this CVE will be REJECTed in the future
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1608: SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via a crafted envelope, sql injection, arbitrary sql commands
CVE-2014-1609: Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified parameters to, sql injection
CVE-2014-1610: MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in (, file upload, unspecified
CVE-2014-1611: Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1612: Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1613: Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a serialized object, dotclear
CVE-2014-1615: Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
Key phrases: hijack the authentication of administrators for requests that, cross-site request forgery (csrf), unspecified action, cross site request forgery
CVE-2014-1617: Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service.
Key phrases: activex control start buffer overflow, denial of service
CVE-2014-1618: Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2014-1619: Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection
CVE-2014-1620: Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1624: Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
Key phrases: overwrite arbitrary files, overwrite arbitrary files by pre-creating /tmp, race condition
CVE-2014-1626: XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.
Key phrases: read arbitrary files, read arbitrary files via a crafted XML file, xml external entity (xxe)
CVE-2014-1631: Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
Key phrases: reinstall the application via direct request to /setup
CVE-2014-1632: htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
Key phrases: execute arbitrary PHP code, inject and execute arbitrary PHP code via the, hostname parameter
CVE-2014-1634: SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.
Key phrases: sql injection
CVE-2014-1635: Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long string in, buffer overflow
CVE-2014-1636: Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2014-1637: Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.
Key phrases: download a database backup via a direct request
CVE-2014-1638: (1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2014-1639: syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2014-1640: axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2014-1642: The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.
Key phrases: execute arbitrary code, denial of service (memory corruption and hypervisor crash), cause a denial of service (memory corruption, use-after-free, double free, use after free
CVE-2014-1643: The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.
Key phrases: read the stored outbound e-mail messages, modified url
CVE-2014-1644: The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
Key phrases: reset arbitrary passwords, reset arbitrary passwords by providing the e-, forgotten-password feature
CVE-2014-1645: SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2014-1646: Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
Key phrases: denial of service (read access violation and application crash), cause a denial of service (read access, memory copies
CVE-2014-1647: Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
Key phrases: denial of service (read access violation and application crash), cause a denial of service (read access
CVE-2014-1648: Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1649: The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.
Key phrases: access files and functionality by sending a crafted
CVE-2014-1650: SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2014-1651: SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2014-1652: Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2014-1663: Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown vectors, unspecified, unspecified vulnerability
CVE-2014-1664: The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.
Key phrases: obtain user IDs, meeting details, and authentication tokens, http requests, sensitive information
CVE-2014-1665: Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1666: The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
Key phrases: denial of service (host or guest malfunction), gain privileges, cause a denial of service (host or, unspecified vectors
CVE-2014-1670: The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
Key phrases: install arbitrary APK files, install arbitrary APK files via vectors involving a
CVE-2014-1671: Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the macAddress element, sql injection, arbitrary sql commands
CVE-2014-1672: Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.
Key phrases: bypass intended access restrictions, anti-spoofing
CVE-2014-1673: Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.
Key phrases: obtain sensitive information, obtain sensitive information (user credentials) via, check point session authentication agent, unspecified
CVE-2014-1677: Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
Key phrases: obtain sensitive information
CVE-2014-1679: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2014-1680: Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory.
Key phrases: gain privileges, gain privileges via a Trojan horse dwmapi.dll file, untrusted search path
CVE-2014-1681: Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting."
Key phrases: multiple unspecified, unknown impact, unspecified vulnerability
CVE-2014-1682: The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
Key phrases: spoof arbitrary users, spoof arbitrary users via the user name in, spoofing
CVE-2014-1683: The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the