Code injection

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-10400

CVE-2014-10400 affects CGILua’s session.lua in 5.0.x, where sequential session IDs enable remote attackers to predict and hijack arbitrary sessions. The vulnerability stems from the use of predictable session IDs, as noted in the CVE description, and CVE-2014-10400 was SPLIT from CVE-2014-2875. P...

CVE-2014-10400

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-10399

In CGILua, CVE-2014-10399 stems from the session.lua library using non-unique/weak session IDs across sessions. CGILua 5.1.x creates identical IDs per session, enabling remote hijacking; CGILua 5.0.x uses sequential IDs; 5.2 alpha releases also generate weak IDs. The vulnerability allows session ...

CVE-2014-10399

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-2875

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID...

CVE-2014-2875

CVE-2014-2875 refers to the session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2, which uses weak session IDs generated from OS time. This allows remote attackers to hijack arbitrary sessions via brute-force guessing. The issue is documented as a split from CVE-2014-10399 and CVE-2014-10400....

DEBIAN-CVE-2014-1958

Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030...

CVE-2014-2030

Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than...

Stack overflow

Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than...

CVE-2014-1958

CVE-2014-1958 : ImageMagick contains a buffer overflow in DecodePSDPixels (coders/psd.c) in versions before 6.8.8-5, potentially allowing a remote attacker to execute arbitrary code via a crafted PSD image, involving the L%06ld string. This CVE is noted as a different vulnerability from CVE-2014-...

CVE-2014-2030

Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than...

CVE-2014-2030

CVE-2014-2030 targets ImageMagick, specifically the WritePSDImage function in coders/psd.c. It is a stack-based buffer overflow that may allow denial of service or remote code execution via a crafted PSD image, involving the L%06ld string; the issue is noted for 6.8.8-5 and is described as a diff...

CVE-2014-8271

The CVE-2014-8271 issue is a buffer overflow in the Reclaim function of the Tianocore EDK2 (and related UEFI implementations) prior to SVN 16280. The vulnerability stems from boundary/bounds checking during the reclaim operation for variable storage, which can enable a local, physically proximate...

CVE-2014-8271

Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0114. Reason: This candidate is a duplicate of CVE-2014-0114. Notes: All CVE users should reference CVE-2014-0114 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2014-3893

...

CVE-2014-3893

CVE-2014-3893 is a duplicate of CVE-2014-0114. Connected docs provide concrete details for CVE-2014-0114 (Apache Struts 1.x): remote code execution via ClassLoader manipulation in the Struts ActionForm, with fixes/mitigations across affected products. Remedies noted include upgrading to patched A...

Security Bulletin: Vulnerability in Apache Commons BeanUtils Affects IBM Sterling B2B Integrator (CVE-2014-0114)

Summary Apache Commons BeanUtils with Struts 1 does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacke...

Security Bulletin: Multiple Vulnerabilities in Apache Commons Affect IBM Sterling B2B Integrator (CVE-2016-3092, CVE-2014-0050, CVE-2013-0248)

Summary Multiple vulnerabilities in Apache Commons exists in IBM Sterling B2B Integrator Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an...