Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-0160
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'name': '[oss-security] 20130107 Re: /dev/ptmx timing', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/08/3'}, {'name': 'USN-2129-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2129-1'}, {'name': 'USN-2128-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2128-1'}, {'name': 'openSUSE-SU-2013:0395', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html'}, {'name': 'SUSE-SU-2013:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=892983'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'name': 'SUSE-SU-2013:1182', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0162
The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=892806'}, {'name': 'RHSA-2013:0548', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0548.html'}, {'name': 'RHSA-2013:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0544.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0163
OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS
Affected Products: OpenShift haproxy cartridge
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0163'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0163'}]
CVE State: PUBLISHED
Explain CVE-2013-0164
The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openshift/origin-server/commit/524465f70a32d0eb6bf047e6a05c76c22d52bfa2'}, {'name': 'RHSA-2013:0220', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0220.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openshift/origin-server/pull/1136'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=893307'}]
CVE State: PUBLISHED
Explain CVE-2013-0165
cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.
Affected Products: OpenShift mongodb cartridge
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0165'}]
CVE State: PUBLISHED
Explain CVE-2013-0167
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=893332'}, {'name': 'RHSA-2013:0907', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2013-0907.html'}, {'name': 'RHSA-2013:0886', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2013-0886.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0168
The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=893355'}, {'name': 'RHSA-2013:0211', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0211.html'}, {'name': 'entreprise-movedisk-dos(81834)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81834'}, {'name': '1028076', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028076'}, {'name': '57750', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57750'}]
CVE State: PUBLISHED
Explain CVE-2013-0170
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-1626', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098398.html'}, {'name': 'openSUSE-SU-2013:0275', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00002.html'}, {'name': '89644', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89644'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/news.html'}, {'name': 'libvirt-virnetmessagefree-code-exec(81552)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81552'}, {'name': 'openSUSE-SU-2013:0274', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00001.html'}, {'name': 'SUSE-SU-2013:0320', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00016.html'}, {'name': 'FEDORA-2013-1644', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098326.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.libvirt.org/page/Maintenance_Releases'}, {'name': '1028047', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028047'}, {'name': 'USN-1708-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1708-1'}, {'name': 'FEDORA-2013-1642', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098370.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=46532e3e8ed5f5a736a02f67d6c805492f9ca720'}, {'name': '52001', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52001'}, {'name': 'RHSA-2013:0199', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0199.html'}, {'name': '57578', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57578'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=893450'}, {'name': '52003', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52003'}]
CVE State: PUBLISHED
Explain CVE-2013-0171
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/2069'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://theforeman.org/security.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0172
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2013-0172'}]
CVE State: PUBLISHED
Explain CVE-2013-0173
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/2069'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://theforeman.org/security.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0174
The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/2069'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://theforeman.org/security.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0175
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/sferik/multi_xml/pull/34'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gist.github.com/nate/d7f6d9f4925f413621aa'}, {'name': '[oss-security] 20130111 Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/11/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0'}, {'tags': ['x_refsource_MISC'], 'url': 'https://news.ycombinator.com/item?id=5040457'}]
CVE State: PUBLISHED
Explain CVE-2013-0176
The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-1407', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098094.html'}, {'name': 'libssh-publickeyfromprivatekey-dos(81595)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81595'}, {'name': '51982', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51982'}, {'name': 'FEDORA-2013-1422', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098065.html'}, {'name': 'USN-1707-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1707-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/'}]
CVE State: PUBLISHED
Explain CVE-2013-0177
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
Affected Products: n/a
References: [{'name': '89453', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89453'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ofbiz.apache.org/download.html#vulnerabilities'}, {'name': '20130118 [CVE-2013-0177] Cross-Site Scripting (XSS) Vulnerability in Apache OFBiz', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/148'}, {'name': '89452', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89452'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395'}, {'name': 'apache-ofbiz-xss(81398)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81398'}, {'name': '51812', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51812'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850'}]
CVE State: PUBLISHED
Explain CVE-2013-0178
Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.
Affected Products: Redis
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0178'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0178'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/14/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/14/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81329'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/antirez/redis/commit/697af434fbeb2e3ba2ba9687cd283ed1a2734fa5'}]
CVE State: PUBLISHED
Explain CVE-2013-0179
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096'}, {'name': '[oss-security] 20130114 CVE request: memcached DoS when printing out keys  to be deleted in verbose mode', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/memcached/wiki/ReleaseNotes1417'}, {'name': '[oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys  to be deleted in verbose mode', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/14/6'}, {'name': 'USN-2080-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2080-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/memcached/issues/detail?id=306'}, {'name': '56183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56183'}, {'name': '64978', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64978'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=895054'}]
CVE State: PUBLISHED
Explain CVE-2013-0180
Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.
Affected Products: Redis
References: [{'name': '[oss-security] 20130114 Re: CVE Request -- redis: Two insecure temporary file use flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/14/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=894659'}]
CVE State: PUBLISHED
Explain CVE-2013-0181
Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
Affected Products: n/a
References: [{'name': '89117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/search_api.git/commitdiff/35b5728'}, {'name': '51806', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51806'}, {'name': '[oss-security] 20130114 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/15/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1884076'}, {'name': '57231', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57231'}, {'name': 'drupal-searchapi-unspecified-xss(81153)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81153'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1884332'}]
CVE State: PUBLISHED
Explain CVE-2013-0182
The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1884360'}, {'name': '[oss-security] 20130114 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/15/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1883830'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1871508'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/payment.git/commitdiff/62c9186'}]
CVE State: PUBLISHED
Explain CVE-2013-0183
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rack/rack/commit/548b9af2dc0059f4c0c19728624448d84de450ff'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=895282'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rack.github.com/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/rack-devel/-MWPHDeGWtI'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/rack-devel/7ZKPNAjgRSs'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'name': 'RHSA-2013:0548', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0548.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rack/rack/commit/f95113402b7239f225282806673e1b6424522b18'}, {'name': 'RHSA-2013:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0544.html'}, {'name': 'DSA-2783', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2783'}]
CVE State: PUBLISHED
Explain CVE-2013-0184
Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=895384'}, {'name': 'openSUSE-SU-2013:0462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html'}, {'name': 'RHSA-2013:0548', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0548.html'}, {'name': 'RHSA-2013:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0544.html'}, {'name': 'DSA-2783', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2783'}]
CVE State: PUBLISHED
Explain CVE-2013-0185
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=895345'}]
CVE State: PUBLISHED
Explain CVE-2013-0186
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: ManageIQ EVM
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0186'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://access.redhat.com/errata/RHSA-2014:0215'}]
CVE State: PUBLISHED
Explain CVE-2013-0189
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request.  NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2012_1.patch'}, {'name': 'DSA-2631', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2631'}, {'name': 'MDVSA-2013:129', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:129'}, {'name': 'USN-1713-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1713-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744'}, {'name': 'SUSE-SU-2016:1996', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0029'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=887962#c9'}, {'name': 'openSUSE-SU-2013:1443', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2012_1.patch'}, {'name': '[scm-commits] 20130125 [squid/f17] CVE-2013-0189: Incomplete fix for the CVE-2012-5643', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.fedoraproject.org/pipermail/scm-commits/2013-January/934637.html'}, {'name': '52024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743'}, {'name': '54839', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54839'}, {'name': 'SUSE-SU-2016:2089', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html'}, {'name': '57646', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57646'}, {'name': 'openSUSE-SU-2013:1436', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=895972'}]
CVE State: PUBLISHED
Explain CVE-2013-0190
The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=896038'}, {'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'name': 'USN-1728-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1728-1'}, {'name': 'USN-1725-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1725-1'}, {'name': '[oss-security] 20130116 [PATCH] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/16/6'}, {'name': '[oss-security] 20130116 Xen Security Advisory 40 (CVE-2013-0190) - Linux stack corruption in xen_failsafe_callback for 32bit PVOPS guests.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/16/8'}, {'name': '57433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57433'}]
CVE State: PUBLISHED
Explain CVE-2013-0191
libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2016:1996', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html'}, {'name': '[oss-security] 20130115 pam-pgsql NULL password handling issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/86'}, {'name': '57440', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57440'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/p/pam-pgsql/bugs/13/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/'}, {'name': 'SUSE-SU-2016:2089', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html'}, {'name': '[oss-security] 20130116 Re: pam-pgsql NULL password handling issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/99'}, {'name': 'libpampgsql-password-sec-bypass(81363)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81363'}]
CVE State: PUBLISHED
Explain CVE-2013-0192
File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.
Affected Products: SMF
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/01/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/17/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/31/1'}]
CVE State: PUBLISHED
Explain CVE-2013-0193
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
Affected Products: piwik
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0193'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/17/15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://matomo.org/changelog/piwik-1-10/'}]
CVE State: PUBLISHED
Explain CVE-2013-0194
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
Affected Products: piwik
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/17/15'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0194'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://matomo.org/changelog/piwik-1-10/'}]
CVE State: PUBLISHED
Explain CVE-2013-0195
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
Affected Products: piwik
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/17/15'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0195'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://matomo.org/changelog/piwik-1-10/'}]
CVE State: PUBLISHED
Explain CVE-2013-0196
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
Affected Products: OpenShift Enterprise
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0196'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0196'}]
CVE State: PUBLISHED
Explain CVE-2013-0197
Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mantisbt.org/bugs/view.php?id=15373'}, {'name': '[oss-security] 20130118 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/125'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html'}, {'name': '[oss-security] 20130121 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/140'}, {'name': '51853', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51853'}, {'name': '[oss-security] 20130118 CVE request: MantisBT before 1.2.13 match_type XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/118'}]
CVE State: PUBLISHED
Explain CVE-2013-0198
Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=894486'}, {'name': 'MDVSA-2013:072', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:072'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commitdiff%3Bh=22ce550e5346947a12a781ed0959a7b1165d0dc6'}, {'name': '[oss-security] 20130118 Re: CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/18/7'}, {'name': '[oss-security] 20130118 CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/18/2'}]
CVE State: PUBLISHED
Explain CVE-2013-0199
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
Affected Products: n/a
References: [{'name': '57542', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57542'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freeipa.org/page/Releases/3.1.2'}, {'name': 'freeipa-crossrealm-info-disc(81486)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81486'}, {'name': '89539', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89539'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freeipa.org/page/CVE-2013-0199'}]
CVE State: PUBLISHED
Explain CVE-2013-0200
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.
Affected Products: n/a
References: [{'name': '55083', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55083'}, {'name': 'USN-1981-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1981-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=902163'}, {'name': 'DSA-2829', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2829'}, {'name': 'MDVSA-2013:088', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:088'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hplipopensource.com/hplip-web/release_notes.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072'}]
CVE State: PUBLISHED
Explain CVE-2013-0201
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.
Affected Products: n/a
References: [{'name': '89511', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89511'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/owncloud/core/commit/b8e0309'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/owncloud/core/commit/4e2b834'}, {'name': '89505', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89505'}, {'name': 'owncloud-mime-token-xss(81475)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81475'}, {'name': '89506', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89506'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-001'}]
CVE State: PUBLISHED
Explain CVE-2013-0202
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.
Affected Products: ownCloud
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81476'}, {'tags': ['x_refsource_MISC'], 'url': 'https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/'}]
CVE State: PUBLISHED
Explain CVE-2013-0203
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/calendar/ajax/event/new.php or (2) url parameter to apps/bookmarks/ajax/addBookmark.php.
Affected Products: ownCloud Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81478'}, {'tags': ['x_refsource_MISC'], 'url': 'https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/'}]
CVE State: PUBLISHED
Explain CVE-2013-0204
settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-002/'}]
CVE State: PUBLISHED
Explain CVE-2013-0205
Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1890216'}, {'name': '[oss-security] 20130121 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/21/5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1890222'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1890212'}]
CVE State: PUBLISHED
Explain CVE-2013-0206
Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1890318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/live_css.git/commitdiff/ef323c8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1883978'}, {'name': '[oss-security] 20130121 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1883976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/live_css.git/commitdiff/cb7005f'}]
CVE State: PUBLISHED
Explain CVE-2013-0207
Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1890566'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1890538'}, {'name': '[oss-security] 20130121 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/mark_complete.git/commitdiff/a18c7b2'}]
CVE State: PUBLISHED
Explain CVE-2013-0208
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad'}, {'name': 'RHSA-2013:0208', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0208.html'}, {'name': '51992', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51992'}, {'name': '51963', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51963'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/nova/+bug/1069904'}, {'name': '[oss-security] 20130129 [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/29/9'}, {'name': '57613', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57613'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b'}, {'name': 'USN-1709-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1709-1'}, {'name': '89661', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89661'}, {'name': 'nova-volume-security-bypass(81697)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81697'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=902629'}]
CVE State: PUBLISHED
Explain CVE-2013-0209
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.sec-1.com/blog/?p=402'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.movabletype.org/2013/01/movable_type_438_patch.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt'}, {'name': '[oss-security] 20130121 Re: CVE request for Movable Type', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/01/22/3'}]
CVE State: PUBLISHED
Explain CVE-2013-0211
Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4'}, {'name': 'FreeBSD-SA-16:23', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-16:23.libarchive.asc'}, {'name': 'MDVSA-2013:147', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:147'}, {'name': 'openSUSE-SU-2015:0568', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-03/msg00065.html'}, {'name': 'FEDORA-2013-4522', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101876.html'}, {'name': '58926', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58926'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=902998'}, {'name': '1035995', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035995'}, {'name': 'USN-2549-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2549-1'}, {'name': 'FEDORA-2013-4592', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101687.html'}, {'name': 'FEDORA-2013-4537', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101872.html'}, {'name': 'FEDORA-2013-4576', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101700.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0212
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1'}, {'name': '[openstack] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.launchpad.net/openstack/msg20517.html'}, {'name': 'USN-1710-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1710-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/glance/+bug/1098962'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/glance/+milestone/2012.2.3'}, {'name': '[oss-security] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/29/10'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=902964'}, {'name': 'RHSA-2013:0209', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0209.html'}, {'name': '51990', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51990'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89'}, {'name': '51957', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51957'}]
CVE State: PUBLISHED