CVE-2014-3605

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2014-0148

CVE-2014-0148 affects QEMU before 2.0, specifically the block driver for Hyper-V VHDX images. The issue arises from missing bounds checks for block_size and logical_sector_size when deriving BAT-related fields, enabling a local user who can modify a disk image to crash the QEMU guest (DoS). Publi...

CVE-2014-0147

CVE-2014-0147 affects QEMU before 1.6.2, where a logic error with signed data types during QCOW2 snapshot creation (impacting QCOW2 and disk image formats used by Bochs) can cause a crash by incorrectly calling update_refcount(). Root cause is a signed data type/logical error in snapshot handling...

CVE-2014-0144

CVE-2014-0144 affects QEMU before 2.0.0: block drivers for CLOOP, QCOW2 v2, and other image formats are vulnerable due to missing input validations that can cause memory corruption, integer/buffer overflows, or crashes. An attacker could potentially execute arbitrary code on the host with QEMU pr...

CVE-2014-5086

A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fwrite in Sphider Pro and Sphider Plus only, but don’t exist...

CVE-2014-5083

A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider...

Command injection

A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider...

Command injection

A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5085 pertains to instances of fwrite in Sphider Plus, but do not exist in either Sphider or Sphider Pro...

Command injection

A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only, but do not exist in either Sphider or Sphider Plus...

CVE-2014-5083

A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider...

CVE-2014-5083

CVE-2014-5083 affects Sphider prior to version 1.3.6, arising from insufficient sanitization of fwrite to conf.php which could allow a remote attacker to execute arbitrary code. Multiple sources (NVD entry) describe a Command Execution vulnerability tied to fwrite usage, with exploitation tied to...

CVE-2014-5084

CVE-2014-5084 affects Sphider Pro 3.2. The vulnerability arises from insufficient sanitization of fwrite, which could let a remote attacker execute arbitrary code. CVE-2014-5084 pertains to fwrite in Sphider Pro only and does not exist in Sphider or Sphider Plus. The connected documents do not pr...

CVE-2014-5085

CVE-2014-5085 affects Sphider Plus 3.2, where insufficient sanitization of fwrite to conf.php allows a remote attacker to execute arbitrary code. The vulnerability is specific to Sphider Plus and does not exist in Sphider or Sphider Pro. The provided documents do not specify any remediation or pa...

CVE-2014-5086

CVE-2014-5086 describes a remote code execution vulnerability in Sphider Pro and Sphider Plus 3.2 caused by insufficient sanitization of fwrite to conf.php. The flaw affects instances of fwrite in Sphider Pro and Sphider Plus only (not in Sphider). The connected documents confirm the root cause (...

CVE-2014-8739

CVE-2014-8739 : Unrestricted file upload in the jQuery File Upload Plugin 6.4.4, used by Creative Solutions Sexy Contact Form (WordPress <= 1.0.0, Joomla! <= 2.0.1), allows remote attackers to upload a PHP file via UploadHandler.php and execute code by requesting the file in the installed f...

CVE-2014-9470

Cross-site scripting XSS vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the qwidget parameter to en/search...

CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2014-7863

The CVE-2014-7863 issue affects the FailOverHelperServlet (FailServlet) in ZOHO ManageEngine OpManager, Applications Manager, and IT360, allowing (1) arbitrary file read via the fileName parameter in a copyfile operation and (2) directory-listing disclosure via listdirectory. Technical details ar...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2014-9126

CVE-2014-9126 affects Open-School Community Edition 2.2. The vulnerability is described as multiple cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary script/HTML via the YII_CSRF_TOKEN HTTP cookie or through the StudentDocument, StudentCategories, and StudentPrevio...