<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1882[/INST]Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1883[/INST]Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phonegap/phonegap/blob/2.6.0/changelog'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1884[/INST]Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1885[/INST]The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1886[/INST]The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1887[/INST]The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1888[/INST]Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Affected Products: n/a
References: [{'name': '65555', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65555'}, {'name': 'buddypress-cve20141888-xss(91175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91175'}, {'name': '56950', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56950'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buddypress.org/2014/02/buddypress-1-9-2'}, {'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531049/100/0/threaded'}, {'name': '103307', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103307'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1889[/INST]The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Affected Products: n/a
References: [{'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531050/100/0/threaded'}, {'name': 'buddypress-cve20141889-sec-bypass(91261)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91261'}, {'name': '65554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65554'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://buddypress.org/2014/02/buddypress-1-9-2/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1891[/INST]Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1892[/INST]Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1893[/INST]Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1894[/INST]Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1895[/INST]Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-85.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}, {'name': '[oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/6'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1896[/INST]The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/xsa86.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-86.html'}, {'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': '[oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/7'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1899[/INST]Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1030186', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030186'}, {'name': '67177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.citrix.com/article/CTX140291'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1900[/INST]Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1901[/INST]Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp.  NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1902[/INST]Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1903[/INST]admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl'}, {'name': '103240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103240'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429'}, {'name': '20140211 Re: Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html'}, {'name': '20140211 Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7123'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7117'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html'}, {'name': '20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531040/100/0/threaded'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1904[/INST]Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gopivotal.com/security/cve-2014-1904'}, {'name': '66137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.springsource.org/browse/SPR-11426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485'}, {'name': '20140311 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531422/100/0/threaded'}, {'name': 'RHSA-2014:0400', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0400.html'}, {'name': '57915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt'}, {'name': '20140312 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/101'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1905[/INST]Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1906[/INST]Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141906-xss(91477)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91477'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1907[/INST]Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141907-dir-trav(91478)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91478'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1908[/INST]The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1909[/INST]Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0636', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00038.html'}, {'name': 'openSUSE-SU-2014:0637', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00039.html'}, {'name': '[oss-security] 20140208 Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/291'}, {'name': 'androidsdk-cve20141909-bo(91291)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91291'}, {'name': '65403', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65403'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1910[/INST]Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': '57020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX140303'}, {'name': '1029791', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029791'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1911[/INST]The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html'}, {'name': 'VU#525132', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/525132'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1912[/INST]Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.python.org/cpython/rev/87673659d8f7'}, {'name': 'openSUSE-SU-2014:0518', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00035.html'}, {'name': 'openSUSE-SU-2014:0597', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html'}, {'name': 'RHSA-2015:1064', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1064.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pastebin.com/raw.php?i=GHXSmNEg'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.python.org/issue20246'}, {'name': 'DSA-2880', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2880'}, {'name': 'GLSA-201503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201503-10'}, {'name': '65379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65379'}, {'name': '[oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/16'}, {'name': 'APPLE-SA-2015-08-13-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html'}, {'name': 'RHSA-2015:1330', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1330.html'}, {'name': '31875', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT205031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html'}, {'name': 'USN-2125-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2125-1'}, {'name': '1029831', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029831'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1914[/INST]Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.
Affected Products: n/a
References: [{'name': '101891', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101891'}, {'name': '101892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101892'}, {'name': 'commandschool-addtopic-xss(90178)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90178'}, {'name': 'commandschool-message-xss(90179)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90179'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1915[/INST]Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php.  NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.
Affected Products: n/a
References: [{'name': '101889', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101889'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'name': '101890', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101890'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1916[/INST]The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.
Affected Products: n/a
References: [{'name': '102957', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102957'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-003.txt'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1921[/INST]parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz'}, {'name': '[oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/308'}, {'name': 'DSA-2860', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2860'}, {'name': 'parcimonie-cve20141921-info-disc(91118)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91118'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134'}, {'name': '65505', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65505'}, {'name': '[oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/305'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1922[/INST]Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660'}, {'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1923[/INST]Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1924[/INST]The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1925[/INST]SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1926[/INST]N\A
Affected Products: N\A
References: N\A
CVE State: REJECTED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1927[/INST]The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1928[/INST]The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/246'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1929[/INST]python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'name': '[oss-security] 20140212 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/335'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1930[/INST]Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
Affected Products: n/a
References: [{'name': 'VU#566894', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/566894'}, {'name': '102814', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/vu/JVNVU97441356/index.html'}, {'name': '65305', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65305'}, {'name': '102815', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102815'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1931[/INST]The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests.
Affected Products: n/a
References: [{'name': '65564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65564'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1932[/INST]The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059'}, {'name': 'GLSA-201612-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-52'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7'}, {'name': '[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'name': 'USN-2168-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2168-1'}, {'name': '65511', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65511'}, {'name': 'openSUSE-SU-2014:0591', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1933[/INST]The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Affected Products: n/a
References: [{'name': 'GLSA-201612-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-52'}, {'name': '[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7'}, {'name': '[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'name': 'USN-2168-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2168-1'}, {'name': 'openSUSE-SU-2014:0591', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html'}, {'name': '65513', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65513'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1934[/INST]tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737062'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063671'}, {'name': 'openSUSE-SU-2014:0619', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00027.html'}, {'name': 'openSUSE-SU-2014:0620', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00028.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1935[/INST]9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1935'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737206'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1936[/INST]rc before 1.7.1-5 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1936'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737125'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1937[/INST]Gamera before 3.4.1 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1937'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737324'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1938[/INST]python-rply before 0.7.4 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1938'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737627'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1939[/INST]java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html'}, {'name': '[oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/11/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_6421'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1942[/INST]Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'VU#163188', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/163188'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1943[/INST]Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0367', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html'}, {'name': '[file] 20140211 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001330.html'}, {'name': '[file] 20142010 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001327.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'name': '[file] 20140213 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001337.html'}, {'name': 'openSUSE-SU-2014:0364', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6443'}, {'name': 'RHSA-2014:1765', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1765.html'}, {'name': '[file] 20140211 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001334.html'}, {'name': 'USN-2126-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2126-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/glensc/file/blob/FILE5_17/ChangeLog'}, {'name': 'DSA-2868', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2868'}, {'name': 'USN-2123-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2123-1'}, {'name': 'DSA-2861', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2861'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1944[/INST]Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.
Affected Products: n/a
References: [{'name': 'ilchcms-cve20141944-xss(91538)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91538'}, {'name': '32076', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/32076'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23203'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7'}, {'name': '20140305 Cross-Site Scripting (XSS) in Ilch CMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531350/100/0/threaded'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1945[/INST]SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.opendocman.com/opendocman-v1-2-7-1-release'}, {'name': '65775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65775'}, {'name': '56189', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56189'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.opendocman.com/opendocman-v1-2-7-2-released'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23202'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1946[/INST]OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.
Affected Products: n/a
References: [{'name': 'opendocman-cve20141946-sec-bypass(91577)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91577'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23202'}, {'name': '20140305 Multiple Vulnerabilities in OpenDocMan', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531351/100/0/threaded'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1947[/INST]Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/13'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/19/13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1064098'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1948[/INST]OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/glance/+bug/1275062'}, {'name': '56419', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56419'}, {'name': 'RHSA-2014:0229', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0229.html'}, {'name': '65507', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65507'}, {'name': '[oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak  (CVE-2014-1948)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/18'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1949[/INST]GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
Affected Products: n/a
References: [{'name': '[oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/327'}, {'name': 'USN-2475-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2475-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145'}, {'name': 'MDVSA-2015:162', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:162'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/linuxmint/cinnamon-screensaver/issues/44'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0374.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1064695'}, {'name': '[oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/331'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1950[/INST]Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/17'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-88.html'}, {'name': 'DSA-3006', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3006'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1955[/INST]Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-13-009/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1956[/INST]CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-13-009/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1957[/INST]FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-13-009/'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-1958[/INST]Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.imagemagick.org/changeset/14801'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ubuntu.com/usn/usn-2132-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.openwall.com/lists/oss-security/2014/02/19/13'}]
CVE State: PUBLISHED</s>