Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-0251
Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699625'}, {'name': '[oss-security] 20130205 Re: CVE id request: latd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/2'}, {'name': '[oss-security] 20130203 Re: CVE id request: latd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/04/3'}]
CVE State: PUBLISHED
Explain CVE-2013-0252
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-2448', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099122.html'}, {'name': '57675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57675'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699649'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=907481'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://svn.boost.org/trac/boost/ticket/7743'}, {'name': '[oss-security] 20130203 Re: CVE id request: boost', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/04/2'}, {'name': 'FEDORA-2013-2420', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099103.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699650'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.boost.org/users/news/boost_locale_security_notice.html'}, {'name': 'USN-1727-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1727-1'}, {'name': 'MDVSA-2013:065', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:065'}]
CVE State: PUBLISHED
Explain CVE-2013-0253
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://maven.apache.org/security.html'}, {'name': 'RHSA-2013:0700', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0700.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917084'}, {'name': '[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2013-0254
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0404', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00015.html'}, {'name': 'RHSA-2013:0669', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0669.html'}, {'name': 'openSUSE-SU-2013:0403', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00014.html'}, {'name': '[qt-announce] 20130205 [Announce] [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.qt-project.org/pipermail/announce/2013-February/000023.html'}, {'name': 'openSUSE-SU-2013:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00019.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=907425'}]
CVE State: PUBLISHED
Explain CVE-2013-0255
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-2123', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html'}, {'name': 'DSA-2630', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2630'}, {'name': 'openSUSE-SU-2013:0319', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html'}, {'name': 'openSUSE-SU-2013:0318', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.4/static/release-8-4-16.html'}, {'name': 'MDVSA-2013:142', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:142'}, {'name': 'postgresql-enumrecv-dos(81917)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81917'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=907892'}, {'name': '51923', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51923'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.1/static/release-9-1-8.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'name': '57844', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57844'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index'}, {'name': 'USN-1717-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1717-1'}, {'name': '1028092', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028092'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.3/static/release-8-3-23.html'}, {'name': '89935', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89935'}, {'name': 'RHSA-2013:1475', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1475.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.2/static/release-9-2-3.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.0/static/release-9-0-12.html'}, {'name': '52819', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52819'}]
CVE State: PUBLISHED
Explain CVE-2013-0256
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0701', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0701.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/'}, {'name': '52774', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52774'}, {'name': 'openSUSE-SU-2013:0303', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2'}, {'name': 'RHSA-2013:0728', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0728.html'}, {'name': 'RHSA-2013:0686', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0686.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60'}, {'name': 'RHSA-2013:0548', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0548.html'}, {'name': 'USN-1733-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1733-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=907820'}, {'name': 'SUSE-SU-2013:0647', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0257
The email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes, which allows remote attackers to read images of user email addresses and email fields.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1903264'}, {'name': '[oss-security] 20130204 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/1'}]
CVE State: PUBLISHED
Explain CVE-2013-0258
The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1903282'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ga_login.git/commitdiff/50b032d'}, {'name': '[oss-security] 20130204 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1902102'}]
CVE State: PUBLISHED
Explain CVE-2013-0259
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
Affected Products: n/a
References: [{'name': '57642', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57642'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1897016'}, {'name': '[oss-security] 20130204 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/boxes.git/commitdiff/456ff8e'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1903300'}]
CVE State: PUBLISHED
Explain CVE-2013-0260
Unspecified vulnerability in the Drush Debian Packaging module for Drupal allows local users to obtain database credentials via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1903324'}, {'name': '[oss-security] 20130204 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/1'}]
CVE State: PUBLISHED
Explain CVE-2013-0261
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0595', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0595.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=908101'}]
CVE State: PUBLISHED
Explain CVE-2013-0262
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/rentzsch/4736940'}, {'name': '52033', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rack.github.com/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909071'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909072'}]
CVE State: PUBLISHED
Explain CVE-2013-0263
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Affected Products: n/a
References: [{'name': '52774', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52774'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11'}, {'name': '52033', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rack.github.com/'}, {'name': '52134', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52134'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909071'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ'}, {'name': 'RHSA-2013:0686', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0686.html'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/cve-2013-0263'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/codahale/f9f3781f7b54985bee94'}, {'tags': ['x_refsource_MISC'], 'url': 'https://twitter.com/coda/statuses/299732877745197056'}, {'name': '89939', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/89939'}, {'name': 'DSA-2783', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2783'}]
CVE State: PUBLISHED
Explain CVE-2013-0264
An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
Affected Products: cumin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0264'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0264'}]
CVE State: PUBLISHED
Explain CVE-2013-0265
The redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow local users to overwrite arbitrary files via a symlink attack on /tmp/xnbd.log.
Affected Products: n/a
References: [{'name': '[oss-security] 20130206 Re: CVE request: Insecure default log file path in  xNBD', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/07/5'}, {'name': '90008', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90008'}, {'name': '[oss-security] 20130206 CVE request: Insecure default log file path in xNBD', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/06/2'}]
CVE State: PUBLISHED
Explain CVE-2013-0266
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=908581'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc'}, {'name': 'RHSA-2013:0595', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0595.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0267
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of service, or conduct cross-site scripting (XSS) attacks by leveraging improper data validation.
Affected Products: n/a
References: [{'name': '[www-announce] 20130506 Apache VCL improper input validation', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/www-announce/201305.mbox/%3C1658214.8zndv4WEi7%40treebeard%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/apache/vcl/commit/56c0f040056d6ad8693b20cfd3351367c2ffeabc#diff-2567a5ec9705eb7ac2c984033e06189d'}, {'name': '[vcl-commits] 20190729 svn commit: r1048217 - in /websites/staging/vcl/trunk/content: ./ security.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/944592973c91cd106a42095271c3f6c7ab9c8d70077b8c6a8d4d92d0%40%3Ccommits.vcl.apache.org%3E'}, {'name': '[vcl-commits] 20190729 svn commit: r1863947 - /vcl/site/trunk/content/security.mdtext', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/632da9e45fce333f21782f1fe10b1d8e77a63811a34fe8e286dedc99%40%3Ccommits.vcl.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2013-0268
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'name': '[oss-security] 20130207 Re: CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/07/12'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c903f0456bc69176912dee6dd25c6a66ee1aed00'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=908693'}, {'name': 'SUSE-SU-2013:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/c903f0456bc69176912dee6dd25c6a66ee1aed00'}]
CVE State: PUBLISHED
Explain CVE-2013-0270
OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/keystone/grizzly/2013.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/keystone/+bug/1099025'}, {'name': 'RHSA-2013:0708', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0708.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0271
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0388', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html'}, {'name': 'USN-1746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1746-1'}, {'name': 'oval:org.mitre.oval:def:18386', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18386'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2'}, {'name': 'openSUSE-SU-2013:0405', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=65'}]
CVE State: PUBLISHED
Explain CVE-2013-0272
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0388', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html'}, {'name': 'USN-1746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1746-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c'}, {'name': '57951', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57951'}, {'name': 'openSUSE-SU-2013:0405', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html'}, {'name': 'oval:org.mitre.oval:def:17474', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17474'}, {'name': 'openSUSE-SU-2013:0407', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=66'}]
CVE State: PUBLISHED
Explain CVE-2013-0273
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0388', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html'}, {'name': 'USN-1746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1746-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=67'}, {'name': 'oval:org.mitre.oval:def:18340', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18340'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd'}, {'name': 'openSUSE-SU-2013:0405', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html'}, {'name': 'openSUSE-SU-2013:0407', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0274
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0388', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=68'}, {'name': 'USN-1746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1746-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3'}, {'name': 'openSUSE-SU-2013:0405', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html'}, {'name': 'openSUSE-SU-2013:0407', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html'}, {'name': 'oval:org.mitre.oval:def:18221', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18221'}]
CVE State: PUBLISHED
Explain CVE-2013-0275
Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '58204', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58204'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=892823'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ganglia.info/?p=566'}, {'name': '[oss-security] 20130208 Re: CVE request: XSS flaws fixed in ganglia', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/08/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ganglia/ganglia-web/commit/31d348947419058c43b8dfcd062e2988abd5058e'}]
CVE State: PUBLISHED
Explain CVE-2013-0276
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
Affected Products: n/a
References: [{'name': '57896', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57896'}, {'name': '52774', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52774'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5784'}, {'name': 'DSA-2620', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2620'}, {'name': 'APPLE-SA-2013-06-04-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html'}, {'name': '[oss-security] 20130211 Circumvention of attr_protected [CVE-2013-0276]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/11/5'}, {'name': 'RHSA-2013:0686', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0686.html'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'name': '90072', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90072'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/'}, {'name': '52112', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52112'}, {'name': '[rubyonrails-security] 20130211 Circumvention of attr_protected [CVE-2013-0276]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain'}]
CVE State: PUBLISHED
Explain CVE-2013-0277
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Affected Products: n/a
References: [{'name': '1028109', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028109'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/cve-2013-0277'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5784'}, {'name': 'DSA-2620', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2620'}, {'name': 'APPLE-SA-2013-06-04-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html'}, {'name': '90073', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90073'}, {'name': '[rubyonrails-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837?dmode=source&output=gplain'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'name': '[oss-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/11/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/'}, {'name': '52112', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52112'}]
CVE State: PUBLISHED
Explain CVE-2013-0281
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
Affected Products: n/a
References: [{'name': 'RHSA-2013:1635', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1635.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=891922'}]
CVE State: PUBLISHED
Explain CVE-2013-0282
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/keystone/+bug/1121494'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22321/'}, {'name': '[oss-security] 20130219 [OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/19/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/keystone/grizzly/2013.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/keystone/+milestone/2012.2.4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22319/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22320/'}]
CVE State: PUBLISHED
Explain CVE-2013-0283
Katello: Username in Notification page has cross site scripting
Affected Products: Katello
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0283'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0283'}]
CVE State: PUBLISHED
Explain CVE-2013-0284
Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
Affected Products: n/a
References: [{'name': '[oss-security] 20130213 Some rubygems related CVEs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/304'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://newrelic.com/docs/ruby/ruby-agent-security-notification'}]
CVE State: PUBLISHED
Explain CVE-2013-0285
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected Products: n/a
References: [{'name': '[oss-security] 20130213 Some rubygems related CVEs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/304'}, {'tags': ['x_refsource_MISC'], 'url': 'https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately'}]
CVE State: PUBLISHED
Explain CVE-2013-0287
The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0559', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00115.html'}, {'name': '52704', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52704'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938'}, {'name': '[sssd-devel] 20130319 [SSSD] A security bug in SSSD 1.9 (CVE-2013-0287)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.fedorahosted.org/pipermail/sssd-devel/2013-March/014066.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb'}, {'name': '58593', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58593'}, {'name': '52722', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52722'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93'}, {'name': '1028317', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028317'}, {'name': 'RHSA-2013:0663', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0663.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb'}]
CVE State: PUBLISHED
Explain CVE-2013-0288
nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288'}, {'name': 'RHSA-2013:0590', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0590.html'}, {'name': '58007', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58007'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319'}, {'name': 'DSA-2628', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2628'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81'}, {'name': '[oss-security] 20130218 CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/18/2'}, {'name': 'FEDORA-2013-2754', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html'}, {'name': '52212', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b'}, {'name': '52242', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52242'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32'}, {'name': 'MDVSA-2013:106', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:106'}, {'name': '[nss-pam-ldapd-announce] 20130218 nss-pam-ldapd security advisory (CVE-2013-0288)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html'}, {'name': 'nsspamldapd-fdsetsize-bo(82175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82175'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071'}, {'name': 'openSUSE-SU-2013:0522', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html'}, {'name': 'openSUSE-SU-2013:0524', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0289
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-2758', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html'}, {'name': '57423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57423'}, {'name': 'isync-ssl-info-disc(82232)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82232'}, {'name': '[oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification  (CVE-2013-0289)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/9'}, {'name': '55190', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55190'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/isync/files/isync/1.0.6/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb'}, {'name': 'GLSA-201310-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-02.xml'}, {'name': 'FEDORA-2013-2795', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0290
The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
Affected Products: n/a
References: [{'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=911473'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=77c1090f94d1b0b5186fb13a1b71b47b1343f87f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/77c1090f94d1b0b5186fb13a1b71b47b1343f87f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.8.bz2'}, {'name': '[oss-security] 20130214 Re: CVE Request: kernel -- local DOS (endless loop with interrupts disabled)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/2'}, {'name': 'openSUSE-SU-2013:1042', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00017.html'}, {'name': 'openSUSE-SU-2013:0951', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0291
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
Affected Products: NextGEN Gallery Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/57957'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/3'}]
CVE State: PUBLISHED
Explain CVE-2013-0292
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': '33614', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/33614'}, {'name': 'MDVSA-2013:071', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:071'}, {'name': '52225', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52225'}, {'name': 'dbus-message-sender-priv-esc(82135)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82135'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658'}, {'name': '52375', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52375'}, {'name': 'USN-1753-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1753-1'}, {'name': 'RHSA-2013:0568', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0568.html'}, {'name': '57985', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57985'}, {'name': '52404', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52404'}, {'name': '[oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in  dbus-glib < 0.100.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': '90302', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90302'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=60916'}]
CVE State: PUBLISHED
Explain CVE-2013-0293
oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
Affected Products: oVirt Node
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0293'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0293'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/13'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58227'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82474'}]
CVE State: PUBLISHED