Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1830?


Explain the CVE ID: What does the identifier CVE-2014-1831 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1831.

Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.


Provide references for further information: Can you share references or external links related to CVE-2014-1831?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phusion/passenger/commit/34b1087870c2'}, {'name': '[oss-security] 20140130 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/30/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1058992'}, {'name': 'FEDORA-2015-1151', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html'}, {'name': '[oss-security] 20140128 CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/28/8'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1831?


Explain the CVE ID: What does the identifier CVE-2014-1832 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1832.

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.


Provide references for further information: Can you share references or external links related to CVE-2014-1832?

{'name': '[oss-security] 20140129 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/29/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958'}, {'name': '[oss-security] 20150130 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/30/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1058992'}, {'name': 'FEDORA-2015-1151', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1832?


Explain the CVE ID: What does the identifier CVE-2014-1833 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1833.

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.


Provide references for further information: Can you share references or external links related to CVE-2014-1833?

{'name': '[oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059947'}, {'name': '65260', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65260'}, {'name': 'devscripts-cve20141833-dir-trav(90842)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90842'}, {'name': '[oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160'}, {'name': 'USN-2649-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2649-1'}, {'name': '102748', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102748'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1833?


Explain the CVE ID: What does the identifier CVE-2014-1834 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1834.

The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.


Provide references for further information: Can you share references or external links related to CVE-2014-1834?

{'name': '[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/10'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1834?


Explain the CVE ID: What does the identifier CVE-2014-1835 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1835.

The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.


Provide references for further information: Can you share references or external links related to CVE-2014-1835?

{'name': '[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/10'}, {'name': 'echor-ruby-system-process-info-disc(90858)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://xforce.iss.net/xforce/xfdb/90858'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1835?


Explain the CVE ID: What does the identifier CVE-2014-1836 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1836.

Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.


Provide references for further information: Can you share references or external links related to CVE-2014-1836?

{'name': '20140203 [CVE-2014-1836] Arbitrary file deletion in ImpressCMS < 1.3.6 and two XSS issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Feb/14'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.impresscms.org/modules/smartsection/item.php?itemid=675'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt'}, {'name': '65279', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65279'}, {'name': '102770', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/102770'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1836?


Explain the CVE ID: What does the identifier CVE-2014-1837 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1837.

Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."


Provide references for further information: Can you share references or external links related to CVE-2014-1837?

{'name': '56577', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56577'}, {'name': '102563', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102563'}, {'name': '65173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65173'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://stackideas.com/downloads/changelog/komento'}, {'name': 'komento-joomla-cve20141837-xss(90974)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90974'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1837?


Explain the CVE ID: What does the identifier CVE-2014-1838 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1838.

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.


Provide references for further information: Can you share references or external links related to CVE-2014-1838?

{'name': 'openSUSE-SU-2014:0306', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html'}, {'name': '57209', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57209'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.logilab.org/ticket/207561'}, {'name': "[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://comments.gmane.org/gmane.comp.security.oss.general/11986'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1838?


Explain the CVE ID: What does the identifier CVE-2014-1839 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1839.

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.


Provide references for further information: Can you share references or external links related to CVE-2014-1839?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.logilab.org/ticket/207562'}, {'name': 'openSUSE-SU-2014:0306', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html'}, {'name': '57209', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57209'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051'}, {'name': "[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://comments.gmane.org/gmane.comp.security.oss.general/11986'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1839?


Explain the CVE ID: What does the identifier CVE-2014-1840 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1840.

Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.


Provide references for further information: Can you share references or external links related to CVE-2014-1840?

{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1840?


Explain the CVE ID: What does the identifier CVE-2014-1841 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1841.

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.


Provide references for further information: Can you share references or external links related to CVE-2014-1841?

{'name': '65462', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65462'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '103195', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103195'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1841?


Explain the CVE ID: What does the identifier CVE-2014-1842 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1842.

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.


Provide references for further information: Can you share references or external links related to CVE-2014-1842?

{'name': '103196', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103196'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1842?


Explain the CVE ID: What does the identifier CVE-2014-1843 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1843.

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.


Provide references for further information: Can you share references or external links related to CVE-2014-1843?

{'name': '103197', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103197'}, {'name': '65469', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65469'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1843?


Explain the CVE ID: What does the identifier CVE-2014-1845 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1845.

An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.


Provide references for further information: Can you share references or external links related to CVE-2014-1845?

{'name': 'enlightenment-helper-priv-esc(91216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91216'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059410'}, {'name': '[oss-security] 20140203 Re: CVE request: enlightenment sysactions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=666df815cd86a50343859bce36c5cf968c5f38b0'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1845?


Explain the CVE ID: What does the identifier CVE-2014-1846 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1846.

Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.


Provide references for further information: Can you share references or external links related to CVE-2014-1846?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059410'}, {'name': '[oss-security] 20140203 Re: CVE request: enlightenment sysactions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/19'}, {'name': 'enlightenment-configuration-priv-esc(91215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91215'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1846?


Explain the CVE ID: What does the identifier CVE-2014-1849 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1849.

Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.


Provide references for further information: Can you share references or external links related to CVE-2014-1849?

{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html'}, {'name': '20140508 CVE-2014-1849 Foscam Dynamic DNS predictable credentials vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/May/35'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1849?


Explain the CVE ID: What does the identifier CVE-2014-1850 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1850.


Provide references for further information: Can you share references or external links related to CVE-2014-1850?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1850?


Explain the CVE ID: What does the identifier CVE-2014-1854 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1854.

SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.


Provide references for further information: Can you share references or external links related to CVE-2014-1854?

{'name': 'adrotate-track-sql-injection(91253)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91253'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5'}, {'name': '20140220 SQL Injection in AdRotate', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531176/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23201'}, {'name': '65709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65709'}, {'name': '31834', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31834'}, {'name': '57079', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57079'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1854?


Explain the CVE ID: What does the identifier CVE-2014-1855 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1855.

Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.


Provide references for further information: Can you share references or external links related to CVE-2014-1855?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23200'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.seopanel.in/viewtopic.php?f=7&t=10978'}, {'name': '58706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58706'}, {'name': '20140516 Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/532119/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/126706/Seo-Panel-3.4.0-Cross-Site-Scripting.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1855?


Explain the CVE ID: What does the identifier CVE-2014-1858 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1858.

__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.


Provide references for further information: Can you share references or external links related to CVE-2014-1858?

{'name': 'FEDORA-2014-2387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/pull/4262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062009'}, {'name': '65441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst'}, {'name': 'numpy-cve20141858-symlink(91318)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91318'}, {'name': '[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/08/3'}, {'name': 'FEDORA-2014-2289', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1858?


Explain the CVE ID: What does the identifier CVE-2014-1859 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1859.

(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.


Provide references for further information: Can you share references or external links related to CVE-2014-1859?

{'name': 'FEDORA-2014-2387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html'}, {'name': '65440', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65440'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/pull/4262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062009'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst'}, {'name': '[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/08/3'}, {'name': 'FEDORA-2014-2289', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html'}, {'name': 'numpy-cve20141859-symlink(91317)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91317'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1859?


Explain the CVE ID: What does the identifier CVE-2014-1860 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1860.

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities


Provide references for further information: Can you share references or external links related to CVE-2014-1860?

{'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/65293'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/14'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/cve/CVE-2014-1860'}, {'name': 'Exploit Database', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-database.net/?id=21609'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1860?


Explain the CVE ID: What does the identifier CVE-2014-1861 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1861.

The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.


Provide references for further information: Can you share references or external links related to CVE-2014-1861?

{'name': '20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0075.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1861?


Explain the CVE ID: What does the identifier CVE-2014-1867 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1867.

suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution


Provide references for further information: Can you share references or external links related to CVE-2014-1867?

{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1867'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/65212'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91315'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1867?


Explain the CVE ID: What does the identifier CVE-2014-1868 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1868.

Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.


Provide references for further information: Can you share references or external links related to CVE-2014-1868?

{'name': '56940', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56940'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements'}, {'name': 'restlet-framework-cve20141868-dos(91181)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91181'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1868?


Explain the CVE ID: What does the identifier CVE-2014-1869 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1869.

Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).


Provide references for further information: Can you share references or external links related to CVE-2014-1869?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/pull/335'}, {'name': 'zeroclipboard-cve20141869-xss(91085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91085'}, {'name': '56821', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56821'}, {'name': '65484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65484'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1869?


Explain the CVE ID: What does the identifier CVE-2014-1870 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1870.

Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.


Provide references for further information: Can you share references or external links related to CVE-2014-1870?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1870?


Explain the CVE ID: What does the identifier CVE-2014-1874 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1874.

The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.


Provide references for further information: Can you share references or external links related to CVE-2014-1874?

{'name': 'USN-2135-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2135-1'}, {'name': 'USN-2138-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2138-1'}, {'name': 'USN-2137-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2137-1'}, {'name': 'USN-2141-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2141-1'}, {'name': 'USN-2129-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2129-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2172fa709ab32ca60e86179dc67d0857be8e2c98'}, {'name': 'USN-2136-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2136-1'}, {'name': 'USN-2128-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2128-1'}, {'name': 'USN-2140-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2140-1'}, {'name': '[oss-security] 20140206 Re: CVE Request: Linux kernel: SELinux local DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/2'}, {'name': '59262', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062356'}, {'name': 'USN-2139-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2139-1'}, {'name': '59309', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59309'}, {'name': '59406', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59406'}, {'name': 'USN-2134-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2134-1'}, {'name': '65459', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65459'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://linux.oracle.com/errata/ELSA-2014-0771.html'}, {'name': 'USN-2133-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2133-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://linux.oracle.com/errata/ELSA-2014-3043.html'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1874?


Explain the CVE ID: What does the identifier CVE-2014-1875 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1875.

The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.


Provide references for further information: Can you share references or external links related to CVE-2014-1875?

{'name': '65475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65475'}, {'name': 'capturetiny-perl-symlink(91464)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91464'}, {'name': '56823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56823'}, {'name': 'FEDORA-2014-2261', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html'}, {'name': '102963', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102963'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062424'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835'}, {'name': 'FEDORA-2014-2321', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html'}, {'name': '[oss-security] 20140206 CVE Request: Capture::Tiny: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes'}, {'name': '[oss-security] 20140206 Re: CVE Request: Capture::Tiny: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dagolden/Capture-Tiny/issues/16'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1875?


Explain the CVE ID: What does the identifier CVE-2014-1876 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1876.

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.


Provide references for further information: Can you share references or external links related to CVE-2014-1876?

{'name': 'USN-2187-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2187-1'}, {'name': 'RHSA-2014:0675', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0675.html'}, {'name': 'RHSA-2014:0414', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2014:0414'}, {'name': 'GLSA-201406-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201406-32.xml'}, {'name': 'USN-2191-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2191-1'}, {'name': 'HPSBUX03091', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=140852886808946&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21672080'}, {'name': 'RHSA-2014:0413', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2014:0413'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1060907'}, {'name': '59058', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59058'}, {'name': 'SSRT101667', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=140852886808946&w=2'}, {'name': 'HPSBUX03092', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=140852974709252&w=2'}, {'name': 'RHSA-2014:0685', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0685.html'}, {'name': 'DSA-2912', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2912'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html'}, {'name': '58415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58415'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562'}, {'name': 'SSRT101668', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=140852974709252&w=2'}, {'name': '[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/285'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21676746'}, {'name': '[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/242'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21679713'}, {'name': '65568', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65568'}, {'name': '102808', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102808'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1876?


Explain the CVE ID: What does the identifier CVE-2014-1877 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1877.

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.


Provide references for further information: Can you share references or external links related to CVE-2014-1877?

{'name': '[oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/258'}, {'name': '[oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/286'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.xchg.info/?p=381'}, {'name': '65416', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65416'}, {'name': 'dokeos-cve20141877-xss(91295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91295'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1877?


Explain the CVE ID: What does the identifier CVE-2014-1878 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1878.

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.


Provide references for further information: Can you share references or external links related to CVE-2014-1878?

{'name': 'openSUSE-SU-2014:0516', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://dev.icinga.org/issues/5434'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1066578'}, {'name': '65605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65605'}, {'name': '[debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html'}, {'name': '57024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57024'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1878?


Explain the CVE ID: What does the identifier CVE-2014-1879 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1879.

Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.


Provide references for further information: Can you share references or external links related to CVE-2014-1879?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php'}, {'name': '65717', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65717'}, {'name': '59832', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59832'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a'}, {'name': 'openSUSE-SU-2014:0344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1879?


Explain the CVE ID: What does the identifier CVE-2014-1881 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1881.

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.


Provide references for further information: Can you share references or external links related to CVE-2014-1881?

{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1881?


Explain the CVE ID: What does the identifier CVE-2014-1882 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1882.

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.


Provide references for further information: Can you share references or external links related to CVE-2014-1882?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1882?


Explain the CVE ID: What does the identifier CVE-2014-1883 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1883.

Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.


Provide references for further information: Can you share references or external links related to CVE-2014-1883?

{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phonegap/phonegap/blob/2.6.0/changelog'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1883?


Explain the CVE ID: What does the identifier CVE-2014-1884 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1884.

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.


Provide references for further information: Can you share references or external links related to CVE-2014-1884?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1884?


Explain the CVE ID: What does the identifier CVE-2014-1885 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1885.

The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.


Provide references for further information: Can you share references or external links related to CVE-2014-1885?

{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1885?


Explain the CVE ID: What does the identifier CVE-2014-1886 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1886.

The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."


Provide references for further information: Can you share references or external links related to CVE-2014-1886?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1886?


Explain the CVE ID: What does the identifier CVE-2014-1887 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1887.

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.


Provide references for further information: Can you share references or external links related to CVE-2014-1887?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1887?


Explain the CVE ID: What does the identifier CVE-2014-1888 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1888.

Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.


Provide references for further information: Can you share references or external links related to CVE-2014-1888?

{'name': '65555', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65555'}, {'name': 'buddypress-cve20141888-xss(91175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91175'}, {'name': '56950', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56950'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buddypress.org/2014/02/buddypress-1-9-2'}, {'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531049/100/0/threaded'}, {'name': '103307', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103307'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1888?


Explain the CVE ID: What does the identifier CVE-2014-1889 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1889.

The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.


Provide references for further information: Can you share references or external links related to CVE-2014-1889?

{'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531050/100/0/threaded'}, {'name': 'buddypress-cve20141889-sec-bypass(91261)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91261'}, {'name': '65554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65554'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://buddypress.org/2014/02/buddypress-1-9-2/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1889?


Explain the CVE ID: What does the identifier CVE-2014-1891 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1891.

Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.


Provide references for further information: Can you share references or external links related to CVE-2014-1891?

{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1891?


Explain the CVE ID: What does the identifier CVE-2014-1892 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1892.

Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.


Provide references for further information: Can you share references or external links related to CVE-2014-1892?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1892?


Explain the CVE ID: What does the identifier CVE-2014-1893 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1893.

Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.


Provide references for further information: Can you share references or external links related to CVE-2014-1893?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1893?


Explain the CVE ID: What does the identifier CVE-2014-1894 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1894.

Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.


Provide references for further information: Can you share references or external links related to CVE-2014-1894?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1894?


Explain the CVE ID: What does the identifier CVE-2014-1895 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1895.

Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.


Provide references for further information: Can you share references or external links related to CVE-2014-1895?

{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-85.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}, {'name': '[oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/6'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1895?


Explain the CVE ID: What does the identifier CVE-2014-1896 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1896.

The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."


Provide references for further information: Can you share references or external links related to CVE-2014-1896?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/xsa86.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-86.html'}, {'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': '[oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/7'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1896?


Explain the CVE ID: What does the identifier CVE-2014-1899 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1899.

Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2014-1899?

{'name': '1030186', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030186'}, {'name': '67177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.citrix.com/article/CTX140291'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1899?


Explain the CVE ID: What does the identifier CVE-2014-1900 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1900.

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.


Provide references for further information: Can you share references or external links related to CVE-2014-1900?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1900?


Explain the CVE ID: What does the identifier CVE-2014-1901 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1901.

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp.  NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.


Provide references for further information: Can you share references or external links related to CVE-2014-1901?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1901?


Explain the CVE ID: What does the identifier CVE-2014-1902 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1902.

Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.


Provide references for further information: Can you share references or external links related to CVE-2014-1902?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1902?


Explain the CVE ID: What does the identifier CVE-2014-1903 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1903.

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.


Provide references for further information: Can you share references or external links related to CVE-2014-1903?

{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl'}, {'name': '103240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103240'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429'}, {'name': '20140211 Re: Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html'}, {'name': '20140211 Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7123'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7117'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html'}, {'name': '20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531040/100/0/threaded'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1903?


Explain the CVE ID: What does the identifier CVE-2014-1904 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1904.

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.


Provide references for further information: Can you share references or external links related to CVE-2014-1904?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gopivotal.com/security/cve-2014-1904'}, {'name': '66137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.springsource.org/browse/SPR-11426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485'}, {'name': '20140311 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531422/100/0/threaded'}, {'name': 'RHSA-2014:0400', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0400.html'}, {'name': '57915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt'}, {'name': '20140312 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/101'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1904?


Explain the CVE ID: What does the identifier CVE-2014-1905 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1905.

Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.


Provide references for further information: Can you share references or external links related to CVE-2014-1905?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1905?


Explain the CVE ID: What does the identifier CVE-2014-1906 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1906.

Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.


Provide references for further information: Can you share references or external links related to CVE-2014-1906?

{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141906-xss(91477)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91477'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1906?


Explain the CVE ID: What does the identifier CVE-2014-1907 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1907.

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.


Provide references for further information: Can you share references or external links related to CVE-2014-1907?

{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141907-dir-trav(91478)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91478'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1907?


Explain the CVE ID: What does the identifier CVE-2014-1908 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1908.

The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.


Provide references for further information: Can you share references or external links related to CVE-2014-1908?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1908?


Explain the CVE ID: What does the identifier CVE-2014-1909 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1909.

Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.


Provide references for further information: Can you share references or external links related to CVE-2014-1909?

{'name': 'openSUSE-SU-2014:0636', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00038.html'}, {'name': 'openSUSE-SU-2014:0637', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00039.html'}, {'name': '[oss-security] 20140208 Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/291'}, {'name': 'androidsdk-cve20141909-bo(91291)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91291'}, {'name': '65403', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65403'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1909?


Explain the CVE ID: What does the identifier CVE-2014-1910 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1910.

Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Provide references for further information: Can you share references or external links related to CVE-2014-1910?

{'name': '57020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX140303'}, {'name': '1029791', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029791'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1910?


Explain the CVE ID: What does the identifier CVE-2014-1911 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1911.

The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.


Provide references for further information: Can you share references or external links related to CVE-2014-1911?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html'}, {'name': 'VU#525132', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/525132'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1911?


Explain the CVE ID: What does the identifier CVE-2014-1912 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1912.

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.


Provide references for further information: Can you share references or external links related to CVE-2014-1912?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.python.org/cpython/rev/87673659d8f7'}, {'name': 'openSUSE-SU-2014:0518', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00035.html'}, {'name': 'openSUSE-SU-2014:0597', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html'}, {'name': 'RHSA-2015:1064', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1064.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pastebin.com/raw.php?i=GHXSmNEg'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.python.org/issue20246'}, {'name': 'DSA-2880', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2880'}, {'name': 'GLSA-201503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201503-10'}, {'name': '65379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65379'}, {'name': '[oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/16'}, {'name': 'APPLE-SA-2015-08-13-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html'}, {'name': 'RHSA-2015:1330', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1330.html'}, {'name': '31875', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT205031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html'}, {'name': 'USN-2125-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2125-1'}, {'name': '1029831', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029831'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1912?


Explain the CVE ID: What does the identifier CVE-2014-1914 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1914.

Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.


Provide references for further information: Can you share references or external links related to CVE-2014-1914?

{'name': '101891', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101891'}, {'name': '101892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101892'}, {'name': 'commandschool-addtopic-xss(90178)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90178'}, {'name': 'commandschool-message-xss(90179)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90179'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1914?


Explain the CVE ID: What does the identifier CVE-2014-1915 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1915.

Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php.  NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.


Provide references for further information: Can you share references or external links related to CVE-2014-1915?

{'name': '101889', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101889'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'name': '101890', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101890'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1915?


Explain the CVE ID: What does the identifier CVE-2014-1916 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1916.

The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.


Provide references for further information: Can you share references or external links related to CVE-2014-1916?

{'name': '102957', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102957'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-003.txt'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1916?


Explain the CVE ID: What does the identifier CVE-2014-1921 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1921.

parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2014-1921?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz'}, {'name': '[oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/308'}, {'name': 'DSA-2860', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2860'}, {'name': 'parcimonie-cve20141921-info-disc(91118)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91118'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134'}, {'name': '65505', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65505'}, {'name': '[oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/305'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1921?


Explain the CVE ID: What does the identifier CVE-2014-1922 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1922.

Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2014-1922?

{'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660'}, {'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1922?


Explain the CVE ID: What does the identifier CVE-2014-1923 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1923.

Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2014-1923?

{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1923?


Explain the CVE ID: What does the identifier CVE-2014-1924 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1924.

The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2014-1924?

{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1924?


Explain the CVE ID: What does the identifier CVE-2014-1925 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1925.

SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.


Provide references for further information: Can you share references or external links related to CVE-2014-1925?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1925?


Explain the CVE ID: What does the identifier CVE-2014-1926 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1926.


Provide references for further information: Can you share references or external links related to CVE-2014-1926?


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1926?


Explain the CVE ID: What does the identifier CVE-2014-1927 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1927.

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


Provide references for further information: Can you share references or external links related to CVE-2014-1927?

{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1927?


Explain the CVE ID: What does the identifier CVE-2014-1928 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1928.

The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


Provide references for further information: Can you share references or external links related to CVE-2014-1928?

{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/246'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1928?


Explain the CVE ID: What does the identifier CVE-2014-1929 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1929.

python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


Provide references for further information: Can you share references or external links related to CVE-2014-1929?

{'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'name': '[oss-security] 20140212 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/335'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1929?


Explain the CVE ID: What does the identifier CVE-2014-1930 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-1930.

Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.


Provide references for further information: Can you share references or external links related to CVE-2014-1930?

{'name': 'VU#566894', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/566894'}, {'name': '102814', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/vu/JVNVU97441356/index.html'}, {'name': '65305', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65305'}, {'name': '102815', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102815'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2014-1930?


Explain the CVE ID: What does the identifier CVE-2014-1931 mean in the context of cybersecurity?