Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-0294
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
Affected Products: pyrad
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=911682'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/57984'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82133'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0296
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0540', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html'}, {'name': '[pigz-announce] 20120728 pigz version 2.2.5 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html'}, {'name': '[oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure  permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/16/3'}, {'name': '[oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608'}]
CVE State: PUBLISHED
Explain CVE-2013-0297
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}]
CVE State: PUBLISHED
Explain CVE-2013-0298
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}]
CVE State: PUBLISHED
Explain CVE-2013-0299
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}]
CVE State: PUBLISHED
Explain CVE-2013-0300
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}]
CVE State: PUBLISHED
Explain CVE-2013-0301
Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}]
CVE State: PUBLISHED
Explain CVE-2013-0302
Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-005/'}]
CVE State: PUBLISHED
Explain CVE-2013-0303
Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-006/'}]
CVE State: PUBLISHED
Explain CVE-2013-0304
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php.  NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-007/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf'}]
CVE State: PUBLISHED
Explain CVE-2013-0305
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2013/feb/19/security/'}, {'name': 'USN-1757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1757-1'}, {'name': 'DSA-2634', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2634'}, {'name': 'RHSA-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0670.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0306
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2013/feb/19/security/'}, {'name': 'USN-1757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1757-1'}, {'name': 'DSA-2634', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2634'}, {'name': 'RHSA-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0670.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0307
Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}]
CVE State: PUBLISHED
Explain CVE-2013-0308
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Products: n/a
References: [{'name': '1028205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028205'}, {'name': 'RHSA-2013:0589', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0589.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5937'}, {'name': 'git-gitimapsend-spoofing(82329)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82329'}, {'name': 'APPLE-SA-2013-09-18-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00007.html'}, {'name': '52361', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52361'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586'}, {'name': '[ANNOUNCE] 20130220 Git v1.8.1.4', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=git&m=136134619013145&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'openSUSE-SU-2013:0380', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00005.html'}, {'name': '58148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58148'}, {'name': '52443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52443'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909977'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=804730'}, {'name': 'openSUSE-SU-2013:0382', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00007.html'}, {'name': '52467', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52467'}]
CVE State: PUBLISHED
Explain CVE-2013-0309
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=027ef6c87853b0a9df53175063028edb4950d476'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912898'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/027ef6c87853b0a9df53175063028edb4950d476'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/4'}]
CVE State: PUBLISHED
Explain CVE-2013-0310
The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=89d7ae34cdda4195809a5a987f697a517a2a3177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/89d7ae34cdda4195809a5a987f697a517a2a3177'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/5'}]
CVE State: PUBLISHED
Explain CVE-2013-0311
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/bd97120fc3d1a11f3124c7c9ba1d91f51829eb85'}, {'name': 'RHSA-2013:0882', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0882.html'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/6'}, {'name': 'RHSA-2013:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0579.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912905'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2'}]
CVE State: PUBLISHED
Explain CVE-2013-0312
389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://directory.fedoraproject.org/wiki/Releases/1.3.0.4'}, {'name': '52568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52568'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912964'}, {'tags': ['x_refsource_MISC'], 'url': 'https://fedorahosted.org/389/ticket/571'}, {'name': '58428', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58428'}, {'name': 'RHSA-2013:0628', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0628.html'}, {'name': '52279', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52279'}]
CVE State: PUBLISHED
Explain CVE-2013-0313
The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/16'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913266'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/a67adb997419fb53540d4a4f79c6471c60bc69b6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a67adb997419fb53540d4a4f79c6471c60bc69b6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5'}]
CVE State: PUBLISHED
Explain CVE-2013-0314
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913327'}, {'name': '52552', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52552'}, {'name': '91120', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/91120'}, {'name': 'RHSA-2013:0613', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0613.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0315
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
Affected Products: n/a
References: [{'name': '91121', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/91121'}, {'name': '52552', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52552'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913340'}, {'name': 'RHSA-2013:0613', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0613.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0316
The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/SA-CORE-2013-002'}]
CVE State: PUBLISHED
Explain CVE-2013-0317
Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1915408'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1916312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/og_manager_change.git/commitdiff/ab7152b'}]
CVE State: PUBLISHED
Explain CVE-2013-0318
The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1916370'}]
CVE State: PUBLISHED
Explain CVE-2013-0319
Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/yandex_metrics.git/commitdiff/80bb901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1921340'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1921342'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/yandex_metrics.git/commitdiff/290b718'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922400'}]
CVE State: PUBLISHED
Explain CVE-2013-0320
Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922170'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/taxonomy_manager.git/commitdiff/2d05801'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922410'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/taxonomy_manager.git/commitdiff/595f1b3'}]
CVE State: PUBLISHED
Explain CVE-2013-0321
Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/uc_views.git/commitdiff/157d5d3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922128'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922416'}]
CVE State: PUBLISHED
Explain CVE-2013-0322
Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ubercart.git/commitdiff/f9d69b5'}, {'name': '52298', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52298'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922136'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922418'}]
CVE State: PUBLISHED
Explain CVE-2013-0323
Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.
Affected Products: n/a
References: [{'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/45d490e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922430'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/90bcd8f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922424'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922438'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/665c791'}]
CVE State: PUBLISHED
Explain CVE-2013-0324
Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922446'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922434'}]
CVE State: PUBLISHED
Explain CVE-2013-0325
Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922756'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/varnish.git/commitdiff/f69a62c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/varnish.git/commitdiff/e6726b4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922726'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922730'}]
CVE State: PUBLISHED
Explain CVE-2013-0326
OpenStack nova base images permissions are world readable
Affected Products: openstack-nova
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0326'}]
CVE State: PUBLISHED
Explain CVE-2013-0327
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914875'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}]
CVE State: PUBLISHED
Explain CVE-2013-0328
Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914876'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}]
CVE State: PUBLISHED
Explain CVE-2013-0329
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914877'}, {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}]
CVE State: PUBLISHED
Explain CVE-2013-0330
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914878'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}]
CVE State: PUBLISHED
Explain CVE-2013-0331
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914879'}, {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}]
CVE State: PUBLISHED
Explain CVE-2013-0332
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zoneminder.com/wiki/index.php/Change_History'}, {'name': 'DSA-2640', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2640'}, {'name': '[oss-security] 20130220 Re: CVE request: zoneminder: local file inclusion vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700912'}, {'name': '[oss-security] 20130221 Re: CVE request: zoneminder: local file inclusion vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/9'}]
CVE State: PUBLISHED
Explain CVE-2013-0333
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Affected Products: n/a
References: [{'name': 'VU#628463', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/628463'}, {'name': 'DSA-2613', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2613'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5784'}, {'name': 'APPLE-SA-2013-06-04-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html'}, {'name': 'APPLE-SA-2013-03-14-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html'}, {'name': '[rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain'}, {'name': 'RHSA-2013:0201', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0201.html'}, {'name': 'RHSA-2013:0202', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0202.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/cve-2013-0333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/'}, {'name': 'RHSA-2013:0203', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0203.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0334
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
Affected Products: n/a
References: [{'name': 'GLSA-201609-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201609-02'}, {'name': 'FEDORA-2014-11649', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.html'}, {'name': 'FEDORA-2014-11630', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'FEDORA-2014-11677', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.html'}, {'name': 'openSUSE-SU-2015:0628', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.html'}, {'name': '70099', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70099'}]
CVE State: PUBLISHED
Explain CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
Affected Products: n/a
References: [{'name': '90657', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90657'}, {'name': '52728', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52728'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/nova/+bug/1125378'}, {'name': '[oss-security] 20130226 [OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22872/'}, {'name': 'USN-1771-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1771-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22758'}, {'name': 'RHSA-2013:0709', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0709.html'}, {'name': '52337', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52337'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22086/'}]
CVE State: PUBLISHED
Explain CVE-2013-0336
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913751'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=7b45e33400355df44e75576ef7f70a39d163bf8e'}, {'name': '58747', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/freeipa/ticket/3539'}, {'name': '52763', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52763'}, {'name': '389directoryserver-cve20130336-dos(83132)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83132'}]
CVE State: PUBLISHED
Explain CVE-2013-0337
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.
Affected Products: n/a
References: [{'name': '55181', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55181'}, {'name': '[oss-security] 20130224 nginx CVE-2013-0337 world-readable logs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/24/1'}, {'name': '[oss-security] 20130221 Re: CVE request: nginx world-readable logdir', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/22/1'}, {'name': 'GLSA-201310-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-04.xml'}, {'name': '[oss-security] 20130221 nginx world-readable logdir', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/15'}]
CVE State: PUBLISHED
Explain CVE-2013-0338
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
Affected Products: n/a
References: [{'name': '52662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52662'}, {'name': 'openSUSE-SU-2013:0555', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html'}, {'name': 'SUSE-SU-2013:1627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912400'}, {'name': 'openSUSE-SU-2013:0552', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html'}, {'name': 'SSRT101996', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=142798889927587&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html'}, {'name': 'DSA-2652', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2652'}, {'name': 'HPSBGN03302', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=142798889927587&w=2'}, {'name': '55568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55568'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab'}, {'name': 'USN-1782-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1782-1'}, {'name': 'MDVSA-2013:056', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:056'}]
CVE State: PUBLISHED
Explain CVE-2013-0339
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
Affected Products: n/a
References: [{'name': '52662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52662'}, {'name': 'SUSE-SU-2013:1627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html'}, {'name': '[oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/21/24'}, {'name': '[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/22/3'}, {'name': '[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/188'}, {'name': '[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/184'}, {'name': '[oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/182'}, {'name': 'USN-1904-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1904-2'}, {'name': 'USN-1904-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1904-1'}, {'name': 'DSA-2652', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2652'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=915149'}, {'name': '54172', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54172'}, {'name': '55568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55568'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f'}, {'name': '[oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/12/6'}]
CVE State: PUBLISHED
Explain CVE-2013-0342
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
Affected Products: pyrad
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=911685'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/22/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/27'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/57984'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82134'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pyradius/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5'}]
CVE State: PUBLISHED