[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0086?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0087 mean in the context of cybersecurity?

[Assistant] CVE-2014-0087


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0087.

[Assistant] The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0087?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0087?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0088 mean in the context of cybersecurity?

[Assistant] CVE-2014-0088


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0088.

[Assistant] The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0088?

[Assistant] [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0088?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0089 mean in the context of cybersecurity?

[Assistant] CVE-2014-0089


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0089.

[Assistant] Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0089?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0089?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0090 mean in the context of cybersecurity?

[Assistant] CVE-2014-0090


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0090.

[Assistant] Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0090?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0090?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0091 mean in the context of cybersecurity?

[Assistant] CVE-2014-0091


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0091.

[Assistant] Foreman has improper input validation which could lead to partial Denial of Service


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0091?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0091?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0092 mean in the context of cybersecurity?

[Assistant] CVE-2014-0092


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0092.

[Assistant] lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0092?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0092?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0093 mean in the context of cybersecurity?

[Assistant] CVE-2014-0093


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0093.

[Assistant] Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0093?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0093?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0094 mean in the context of cybersecurity?

[Assistant] CVE-2014-0094


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0094.

[Assistant] The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0094?

[Assistant]
20140306 [ANN] Struts 2.3.16.1 GA release available - security fix

20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0094?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0095 mean in the context of cybersecurity?

[Assistant] CVE-2014-0095


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0095.

[Assistant] java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0095?

[Assistant] 20140527 [SECURITY] CVE-2014-0095 Apache Tomcat denial of service


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0095?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0096 mean in the context of cybersecurity?

[Assistant] CVE-2014-0096


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0096.

[Assistant] java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0096?

[Assistant]
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/

[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/

[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0096?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0097 mean in the context of cybersecurity?

[Assistant] CVE-2014-0097


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0097.

[Assistant] The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0097?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0097?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0098 mean in the context of cybersecurity?

[Assistant] CVE-2014-0098


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0098.

[Assistant] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0098?

[Assistant]
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/

[httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0098?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0099 mean in the context of cybersecurity?

[Assistant] CVE-2014-0099


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0099.

[Assistant] Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0099?

[Assistant]
20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure

20140527 [SECURITY]  Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure

20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure

[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/

[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/

[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0099?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0100 mean in the context of cybersecurity?

[Assistant] CVE-2014-0100


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0100.

[Assistant] Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0100?

[Assistant] [oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0100?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0101 mean in the context of cybersecurity?

[Assistant] CVE-2014-0101


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0101.

[Assistant] The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0101?

[Assistant] [oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0101?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0102 mean in the context of cybersecurity?

[Assistant] CVE-2014-0102


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0102.

[Assistant] The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0102?

[Assistant]
[oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS

[linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003!


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0102?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0103 mean in the context of cybersecurity?

[Assistant] CVE-2014-0103


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0103.

[Assistant] WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0103?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0103?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0104 mean in the context of cybersecurity?

[Assistant] CVE-2014-0104


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0104.

[Assistant] In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0104?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0104?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0105 mean in the context of cybersecurity?

[Assistant] CVE-2014-0105


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0105.

[Assistant] The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0105?

[Assistant] [oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware  (CVE-2014-0105)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0105?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0106 mean in the context of cybersecurity?

[Assistant] CVE-2014-0106


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0106.

[Assistant] Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0106?

[Assistant] [oss-security] 20140305 sudo: security policy bypass when env_reset is disabled


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0106?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0107 mean in the context of cybersecurity?

[Assistant] CVE-2014-0107


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0107.

[Assistant] The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0107?

[Assistant]
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[tomcat-dev] 20210823 [Bug 65516] New: upgrade to xalan 2.7.2 to address CVE-2014-0107

[tomcat-dev] 20210823 [Bug 65516] upgrade to xalan 2.7.2 to address CVE-2014-0107


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0107?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0108 mean in the context of cybersecurity?

[Assistant] CVE-2014-0108


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0108.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0108?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0108?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0109 mean in the context of cybersecurity?

[Assistant] CVE-2014-0109


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0109.

[Assistant] Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0109?

[Assistant]
[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html

[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html

[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html

[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html

[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html

[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0109?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0110 mean in the context of cybersecurity?

[Assistant] CVE-2014-0110


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0110.

[Assistant] Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0110?

[Assistant]
[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html

[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html

[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html

[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html

[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html

[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0110?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0111 mean in the context of cybersecurity?

[Assistant] CVE-2014-0111


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0111.

[Assistant] Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0111?

[Assistant]
[www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope

20140415 [SECURITY] CVE-2014-0111 Apache Syncope


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0111?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0112 mean in the context of cybersecurity?

[Assistant] CVE-2014-0112


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0112.

[Assistant] ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0112?

[Assistant]
20140426 [ANN] Struts 2.3.16.2 GA release available - security fix

20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0112?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0113 mean in the context of cybersecurity?

[Assistant] CVE-2014-0113


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0113.

[Assistant] CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0113?

[Assistant] 20140426 [ANN] Struts 2.3.16.2 GA release available - security fix


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0113?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0114 mean in the context of cybersecurity?

[Assistant] CVE-2014-0114


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0114.

[Assistant] Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0114?

[Assistant]
[apache-ignite-developers] 20180601  [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114

[oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report

[infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities

[pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities

[commons-issues] 20190521 [jira] [Created] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-issues] 20190522 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-issues] 20190522 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-dev] 20190522 [beanutils2] CVE-2014-0114 Pull Request

[commons-dev] 20190525 Re: [beanutils2] CVE-2014-0114 Pull Request

[commons-commits] 20190528 [commons-beanutils] branch master updated: BEANUTILS-520: Mitigate CVE-2014-0114 by enabling SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS by default. (#7)

[commons-issues] 20190528 [jira] [Closed] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #74

[commons-commits] 20190528 [commons-beanutils] branch master updated: [BEANUTILS-520] BeanUtils2 mitigate CVE-2014-0114.

[commons-issues] 20190528 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #75

[commons-dev] 20190605 Re: [beanutils] Towards 1.10

[commons-issues] 20190615 [jira] [Updated] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-issues] 20190615 [jira] [Reopened] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-issues] 20190615 [jira] [Resolved] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[commons-dev] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.

[commons-user] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.

[announce] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.

[commons-issues] 20190818 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114

[activemq-gitbox] 20190903 [GitHub] [activemq-artemis] jeloba opened a new pull request #2820: Updated Apache BeanUtils to address CVE

[activemq-issues] 20190904 [jira] [Created] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114

[commons-commits] 20190906 [commons-configuration] branch master updated: [CONFIGURATION-755][CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.

[commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.

[commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.

[activemq-issues] 20190909 [jira] [Work logged] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114

[commons-issues] 20191014 [jira] [Updated] (BEANUTILS-520) Mitigate CVE-2014-0114

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities

[activemq-issues] 20200109 [jira] [Resolved] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114

[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1

[lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1

[dolphinscheduler-commits] 20210121 [GitHub] [incubator-dolphinscheduler] c-f-cooper commented on issue #4506: There is a vulnerability in beanutils 1.7.0,upgrade recommended


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0114?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0115 mean in the context of cybersecurity?

[Assistant] CVE-2014-0115


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0115.

[Assistant] Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0115?

[Assistant] [storm-dev] 20140429 [jira] [Commented] (STORM-269) Any readable file exposed via UI log viewer


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0115?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0116 mean in the context of cybersecurity?

[Assistant] CVE-2014-0116


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0116.

[Assistant] CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0116?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0116?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0117 mean in the context of cybersecurity?

[Assistant] CVE-2014-0117


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0117.

[Assistant] The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0117?

[Assistant]
20140722 Apache HTTPd - description of the CVE-2014-0117.

[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/

[httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0117?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0118 mean in the context of cybersecurity?

[Assistant] CVE-2014-0118


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0118.

[Assistant] The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0118?

[Assistant]
[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/

[httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0118?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0119 mean in the context of cybersecurity?

[Assistant] CVE-2014-0119


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0119.

[Assistant] Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0119?

[Assistant]
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/

[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/

[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/

[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0119?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0120 mean in the context of cybersecurity?

[Assistant] CVE-2014-0120


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0120.

[Assistant] Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0120?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0120?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0121 mean in the context of cybersecurity?

[Assistant] CVE-2014-0121


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0121.

[Assistant] The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0121?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0121?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0122 mean in the context of cybersecurity?

[Assistant] CVE-2014-0122


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0122.

[Assistant] mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0122?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0122?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0123 mean in the context of cybersecurity?

[Assistant] CVE-2014-0123


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0123.

[Assistant] The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0123?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0123?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0124 mean in the context of cybersecurity?

[Assistant] CVE-2014-0124


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0124.

[Assistant] The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0124?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0124?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0125 mean in the context of cybersecurity?

[Assistant] CVE-2014-0125


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0125.

[Assistant] repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0125?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0125?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0126 mean in the context of cybersecurity?

[Assistant] CVE-2014-0126


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0126.

[Assistant] Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0126?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0126?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0127 mean in the context of cybersecurity?

[Assistant] CVE-2014-0127


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0127.

[Assistant] The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0127?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0127?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0128 mean in the context of cybersecurity?

[Assistant] CVE-2014-0128


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0128.

[Assistant] Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0128?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0128?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0129 mean in the context of cybersecurity?

[Assistant] CVE-2014-0129


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0129.

[Assistant] badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0129?

[Assistant] [oss-security] 20140317 Moodle security notifications public


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0129?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0130 mean in the context of cybersecurity?

[Assistant] CVE-2014-0130


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0130.

[Assistant] Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0130?

[Assistant] [rubyonrails-security] 20140506 [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0130?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0131 mean in the context of cybersecurity?

[Assistant] CVE-2014-0131


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0131.

[Assistant] Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0131?

[Assistant]
[netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs

[netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying

[oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0131?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0132 mean in the context of cybersecurity?

[Assistant] CVE-2014-0132


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0132.

[Assistant] The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0132?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0132?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0133 mean in the context of cybersecurity?

[Assistant] CVE-2014-0133


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0133.

[Assistant] Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0133?

[Assistant] [nginx-announce] 20140318 nginx security advisory (CVE-2014-0133)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0133?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0134 mean in the context of cybersecurity?

[Assistant] CVE-2014-0134


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0134.

[Assistant] The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0134?

[Assistant] [oss-security] 20140327 [OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0134?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0135 mean in the context of cybersecurity?

[Assistant] CVE-2014-0135


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0135.

[Assistant] Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0135?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0135?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0136 mean in the context of cybersecurity?

[Assistant] CVE-2014-0136


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0136.

[Assistant] The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0136?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0136?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0137 mean in the context of cybersecurity?

[Assistant] CVE-2014-0137


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0137.

[Assistant] SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0137?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0137?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0138 mean in the context of cybersecurity?

[Assistant] CVE-2014-0138


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0138.

[Assistant] The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0138?

[Assistant]
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0138?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0139 mean in the context of cybersecurity?

[Assistant] CVE-2014-0139


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0139.

[Assistant] cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0139?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0139?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0140 mean in the context of cybersecurity?

[Assistant] CVE-2014-0140


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0140.

[Assistant] Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0140?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0140?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0141 mean in the context of cybersecurity?

[Assistant] CVE-2014-0141


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0141.

[Assistant] Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0141?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0141?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0142 mean in the context of cybersecurity?

[Assistant] CVE-2014-0142


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0142.

[Assistant] QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0142?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0142?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0143 mean in the context of cybersecurity?

[Assistant] CVE-2014-0143


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0143.

[Assistant] Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0143?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0143?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0144 mean in the context of cybersecurity?

[Assistant] CVE-2014-0144


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0144.

[Assistant] QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0144?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0144?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0145 mean in the context of cybersecurity?

[Assistant] CVE-2014-0145


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0145.

[Assistant] Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0145?

[Assistant] [oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0145?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0146 mean in the context of cybersecurity?

[Assistant] CVE-2014-0146


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0146.

[Assistant] The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0146?

[Assistant] [oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0146?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0147 mean in the context of cybersecurity?

[Assistant] CVE-2014-0147


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0147.

[Assistant] Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0147?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0147?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0148 mean in the context of cybersecurity?

[Assistant] CVE-2014-0148


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0148.

[Assistant] Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0148?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0148?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0149 mean in the context of cybersecurity?

[Assistant] CVE-2014-0149


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0149.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0149?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0149?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0150 mean in the context of cybersecurity?

[Assistant] CVE-2014-0150


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0150.

[Assistant] Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0150?

[Assistant]
[Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun

[Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0150?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0151 mean in the context of cybersecurity?

[Assistant] CVE-2014-0151


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0151.

[Assistant] Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0151?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0151?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0152 mean in the context of cybersecurity?

[Assistant] CVE-2014-0152


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0152.

[Assistant] Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0152?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0152?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0153 mean in the context of cybersecurity?

[Assistant] CVE-2014-0153


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0153.

[Assistant] The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0153?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0153?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0154 mean in the context of cybersecurity?

[Assistant] CVE-2014-0154


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0154.

[Assistant] oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0154?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0154?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0155 mean in the context of cybersecurity?

[Assistant] CVE-2014-0155


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0155.

[Assistant] The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0155?

[Assistant] [oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0155?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0156 mean in the context of cybersecurity?

[Assistant] CVE-2014-0156


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0156.

[Assistant] Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0156?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0156?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0157 mean in the context of cybersecurity?

[Assistant] CVE-2014-0157


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0157.

[Assistant] Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0157?

[Assistant] [oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0157?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0158 mean in the context of cybersecurity?

[Assistant] CVE-2014-0158


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0158.

[Assistant] Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0158?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0158?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0159 mean in the context of cybersecurity?

[Assistant] CVE-2014-0159


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0159.

[Assistant] Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0159?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0159?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0160 mean in the context of cybersecurity?

[Assistant] CVE-2014-0160


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0160.

[Assistant] The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0160?

[Assistant]
20140408 heartbleed OpenSSL bug CVE-2014-0160

20140409 Re: heartbleed OpenSSL bug CVE-2014-0160

20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

[syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released

20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20140408 Re: heartbleed OpenSSL bug CVE-2014-0160

20140412 Re: heartbleed OpenSSL bug CVE-2014-0160

[tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

[tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

[tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/

[tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0160?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0161 mean in the context of cybersecurity?

[Assistant] CVE-2014-0161


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0161.

[Assistant] ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0161?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0161?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0162 mean in the context of cybersecurity?

[Assistant] CVE-2014-0162


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0162.

[Assistant] The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0162?

[Assistant] [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0162?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0163 mean in the context of cybersecurity?

[Assistant] CVE-2014-0163


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0163.

[Assistant] Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0163?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0163?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2014-0164 mean in the context of cybersecurity?

[Assistant] CVE-2014-0164


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2014-0164.

[Assistant] openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2014-0164?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2014-0164?

[Assistant] PUBLISHED