Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1378
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-11.html'}, {'name': 'HPSBMU02948', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139455789818399&w=2'}, {'name': 'RHSA-2013:0730', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0730.html'}, {'name': 'openSUSE-SU-2013:0672', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html'}, {'name': 'openSUSE-SU-2013:0675', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1379
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-11.html'}, {'name': 'HPSBMU02948', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139455789818399&w=2'}, {'name': 'RHSA-2013:0730', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0730.html'}, {'name': 'openSUSE-SU-2013:0672', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html'}, {'name': 'openSUSE-SU-2013:0675', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1380
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1378.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-11.html'}, {'name': 'HPSBMU02948', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139455789818399&w=2'}, {'name': 'RHSA-2013:0730', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0730.html'}, {'name': 'openSUSE-SU-2013:0672', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html'}, {'name': 'openSUSE-SU-2013:0675', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1383
Buffer overflow in Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-12.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1384
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1386.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-12.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1385
Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-12.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1386
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1384.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-12.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1387
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-10.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1388
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-10.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1389
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-13.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1391
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.rapid7.com/db/modules/auxiliary/scanner/misc/dvr_config_disclosure'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html'}, {'name': '57579', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'https://www.securityfocus.com/bid/57579/info'}]
CVE State: PUBLISHED
Explain CVE-2013-1393
Cross-site scripting (XSS) vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119814/CurvyCorners-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119766/Drupal-CurvyCorners-6.x-7.x-Cross-Site-Scripting.html'}, {'name': '20130123 CVE-2013-1393', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/218'}, {'name': '89571', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89571'}, {'name': '20130123 [Security-news] SA-CONTRIB-2013-008 - CurvyCorners - Cross Site Scripting (XSS) - module unsupported', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/211'}, {'name': '57526', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57526'}, {'name': 'drupal-curvycorners-unspecified-xss(81499)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81499'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/misc/files/advisories/CVE-2013-1393.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1896718'}]
CVE State: PUBLISHED
Explain CVE-2013-1397
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
Affected Products: n/a
References: [{'name': '51980', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51980'}, {'name': '57574', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57574'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released'}, {'name': 'symfony-php-objects-code-execution(81551)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81551'}]
CVE State: PUBLISHED
Explain CVE-2013-1398
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://puppetlabs.com/security/cve/cve-2013-1398'}]
CVE State: PUBLISHED
Explain CVE-2013-1399
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppetlabs.com/security/cve/cve-2013-1399'}]
CVE State: PUBLISHED
Explain CVE-2013-1400
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
Affected Products: n/a
References: [{'name': '57479', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57479'}, {'name': '81466', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81466'}, {'name': '20130121 Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/525370'}]
CVE State: PUBLISHED
Explain CVE-2013-1401
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
Affected Products: n/a
References: [{'name': '57479', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57479'}, {'name': '20130121 Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/525370'}, {'name': '81467', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81467'}]
CVE State: PUBLISHED
Explain CVE-2013-1402
DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.
Affected Products: n/a
References: [{'name': '20130122 CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-01/0095.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1405
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2013-0001.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1406
The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:17164', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2013-0002.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1407
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Affected Products: n/a
References: [{'name': '20130306 Multiple XSS vulnerabilities in Events Manager WordPress plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23139'}]
CVE State: PUBLISHED
Explain CVE-2013-1408
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120089/WordPress-Wysija-Newsletters-2.2-SQL-Injection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23140'}, {'name': 'wp-wysijanewsletters-admin-sql-injection(81932)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81932'}, {'name': '89924', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89924'}, {'name': '57775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57775'}, {'name': '20130206 SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-02/0030.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1409
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://wordpress.org/plugins/commentluv/changelog'}, {'name': '20130206 Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-02/0031.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23138'}, {'name': '89925', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89925'}]
CVE State: PUBLISHED
Explain CVE-2013-1410
Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-database.net/?id=59355'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.securityfocus.com/bid/57514/info'}]
CVE State: PUBLISHED
Explain CVE-2013-1412
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
Affected Products: n/a
References: [{'name': '57603', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57603'}, {'name': '24444', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24444'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html'}, {'name': '89662', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89662'}, {'name': '24438', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24438'}, {'name': '20130128 [KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-01/0117.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://karmainsecurity.com/KIS-2013-01'}, {'name': '51971', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51971'}]
CVE State: PUBLISHED
Explain CVE-2013-1413
Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/en/modules/news/news_0076.html_533560828.html'}, {'name': '52415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52415'}, {'name': '20130301 CVE-2013-1413', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/0'}, {'name': '56834', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56834'}]
CVE State: PUBLISHED
Explain CVE-2013-1414
Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.
Affected Products: n/a
References: [{'name': '26528', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/26528/'}]
CVE State: PUBLISHED
Explain CVE-2013-1415
The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
Affected Products: n/a
References: [{'name': '55040', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55040'}, {'name': 'MDVSA-2013:157', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:157'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/www/krb5-1.10/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=7570'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=7577'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/www/krb5-1.11/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/krb5/krb5/commit/f249555301940c6df3a2cdda13b56b5674eebc2e'}, {'name': 'openSUSE-SU-2013:0523', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00090.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1416
The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.
Affected Products: n/a
References: [{'name': 'MDVSA-2013:157', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:157'}, {'name': 'openSUSE-SU-2013:0904', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00041.html'}, {'name': 'MDVSA-2013:158', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:158'}, {'name': 'FEDORA-2013-5286', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102074.html'}, {'name': 'openSUSE-SU-2013:0967', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00102.html'}, {'name': 'openSUSE-SU-2013:0746', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-05/msg00011.html'}, {'name': 'FEDORA-2013-5280', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102058.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/krb5/krb5/commit/8ee70ec63931d1e38567905387ab9b1d45734d81'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600'}, {'name': 'RHSA-2013:0748', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0748.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1417
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1030743'}, {'name': 'openSUSE-SU-2013:1833', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc'}]
CVE State: PUBLISHED
Explain CVE-2013-1418
The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1026942'}, {'name': 'openSUSE-SU-2013:1738', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-11/msg00082.html'}, {'name': '[debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2013-0335.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d'}, {'name': 'openSUSE-SU-2013:1751', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-11/msg00086.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/krb5-1.10/README-1.10.7.txt'}, {'name': '63555', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/63555'}, {'name': 'openSUSE-SU-2013:1833', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt'}]
CVE State: PUBLISHED
Explain CVE-2013-1420
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23141'}, {'tags': ['x_refsource_MISC'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-05/0005.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://get-simple.info/changelog'}]
CVE State: PUBLISHED
Explain CVE-2013-1421
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.7/'}, {'name': '90669', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90669'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/'}]
CVE State: PUBLISHED
Explain CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/07/22/8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/07/25/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.securityfocus.com/bid/58250/info'}]
CVE State: PUBLISHED
Explain CVE-2013-1423
(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8) plugins/scmcvs/common/CVSPlugin.class.php, (9) plugins/scmcvs/cronjobs/cvs.php, (10) plugins/scmcvs/cronjobs/ssh_create.php, (11) plugins/scmgit/common/GitPlugin.class.php, (12) plugins/scmsvn/common/SVNPlugin.class.php, (13) plugins/wiki/cronjobs/create_groups.php, (14) utils/cvs1/cvscreate.sh, and (15) utils/include.pl in FusionForge 5.0, 5.1, and 5.2 allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a (1) symlink or (2) hard link attack on certain files.
Affected Products: n/a
References: [{'name': '58143', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58143'}, {'name': 'DSA-2633', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2633'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=9937b9d94ab60ff67fe249c1b9a6c8e3fc1778ba'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=1fc730b97c797e03b89cd37823ab345d35286cf4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=0cc51b3aca51fa915a35195fdf729bcdb903f2af'}, {'name': '[oss-security] 20130225 fusionforge CVE-2013-1423 multiple privilege escalations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/25/5'}, {'name': '52371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52371'}, {'name': '52318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52318'}, {'name': '90605', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90605'}]
CVE State: PUBLISHED
Explain CVE-2013-1425
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
Affected Products: ldap-git-backup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1425'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1096253.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/elmar/ldap-git-backup/commit/a90f3217fce87962db82d212f73af70693087124'}]
CVE State: PUBLISHED
Explain CVE-2013-1426
Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.
Affected Products: mahara
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mahara.org/interaction/forum/topic.php?id=5365'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/mahara/+bug/1153423'}]
CVE State: PUBLISHED
Explain CVE-2013-1427
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
Affected Products: n/a
References: [{'name': '91462', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91462'}, {'name': 'lighttpd-cve20131427-symlink(82897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82897'}, {'name': '58528', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58528'}, {'name': 'DSA-2649', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2649'}]
CVE State: PUBLISHED
Explain CVE-2013-1428
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/gsliepen/tinc/commit/17a33dfd95b1a29e90db76414eb9622df9632320'}, {'name': 'FEDORA-2013-7120', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105559.html'}, {'name': '[tinc] 20130422 [Announcement] Tinc version 1.0.21 and 1.1pre7 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.tinc-vpn.org/pipermail/tinc/2013-April/003240.html'}, {'name': 'FEDORA-2013-7085', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106167.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tinc-vpn.org/news/'}, {'name': '92653', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92653'}, {'name': '53087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53087'}, {'name': '53108', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53108'}, {'name': 'DSA-2663', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2663'}, {'name': '59369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59369'}, {'name': 'FEDORA-2013-7128', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105531.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://freecode.com/projects/tinc/releases/354122'}]
CVE State: PUBLISHED
Explain CVE-2013-1429
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.
Affected Products: lintian
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1429'}, {'tags': ['x_refsource_MISC'], 'url': 'https://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1429.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1113881.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/lintian/+bug/1169636'}]
CVE State: PUBLISHED
Explain CVE-2013-1430
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
Affected Products: xrdp before 0.9.1
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1430'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/neutrinolabs/xrdp/pull/497'}, {'name': '94958', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/94958'}]
CVE State: PUBLISHED
Explain CVE-2013-1431
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
Affected Products: n/a
References: [{'name': '[oss-security] 20130530 CVE-2013-1431: telepathy-gabble: TLS bypass via use of legacy Jabber', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q2/438'}, {'name': '53779', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53779'}, {'name': 'USN-1873-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1873-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=65036'}, {'name': 'DSA-2702', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2702'}]
CVE State: PUBLISHED
Explain CVE-2013-1432
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': '[oss-security] 20130626 Xen Security Advisory 58 (CVE-2013-1432) - Page reference counting error due to XSA-45/CVE-2013-1918 fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/06/26/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX138134'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'DSA-3006', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3006'}]
CVE State: PUBLISHED
Explain CVE-2013-1434
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '54181', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54181'}, {'name': '61657', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/61657'}, {'name': 'openSUSE-SU-2013:1377', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00053.html'}, {'name': 'DSA-2739', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2739'}, {'name': '54386', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54386'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.cacti.net/viewvc?view=rev&revision=7394'}, {'name': '1028893', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028893'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forums.cacti.net/viewtopic.php?f=21&t=50593'}, {'name': '[oss-security] 20130807 Re: CVE request: SQL injection and shell escaping  issues in Cacti < 0.8.8b', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/08/07/15'}]
CVE State: PUBLISHED
Explain CVE-2013-1435
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Affected Products: n/a
References: [{'name': '54181', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54181'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.cacti.net/viewvc?view=rev&revision=7392'}, {'name': 'openSUSE-SU-2013:1377', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00053.html'}, {'name': 'DSA-2739', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2739'}, {'name': '54386', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54386'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.cacti.net/viewvc?view=rev&revision=7393'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forums.cacti.net/viewtopic.php?f=21&t=50593'}, {'name': '[oss-security] 20130807 Re: CVE request: SQL injection and shell escaping  issues in Cacti < 0.8.8b', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/08/07/15'}]
CVE State: PUBLISHED
Explain CVE-2013-1436
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
Affected Products: n/a
References: [{'name': '61491', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/61491'}, {'name': 'GLSA-201405-28', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201405-28.xml'}, {'name': '[oss-security] 20130726 CVE-2013-1436: xmonad-contrib remote command injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/07/26/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib&repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89'}]
CVE State: PUBLISHED
Explain CVE-2013-1437
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
Affected Products: Module-Metadata
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://metacpan.org/changes/distribution/Module-Metadata'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114904.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114912.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1438
Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.
Affected Products: n/a
References: [{'name': 'DSA-2748', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2748'}, {'name': '62060', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/62060'}, {'name': '[oss-security] 20130829 [notification] libraw: multiple denial of service vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/08/29/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1439
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
Affected Products: n/a
References: [{'name': 'DSA-2748', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2748'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad'}, {'name': '[oss-security] 20130829 [notification] libraw: multiple denial of service vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/08/29/3'}]
CVE State: PUBLISHED
Explain CVE-2013-1441
econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=collab-maint/exactimage.git%3Ba=commitdiff%3Bh=1dff2eb586a3d10d8528a984bc471292e3789f5c%3Bhp=acfe54193b18b46e880f4b474d2e40b4fdb44a8d'}, {'name': 'DSA-2754', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2754'}, {'name': '[oss-security] 20130805 [notification] exactimage DoS, jumping into the unknown', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/09/05/8'}]
CVE State: PUBLISHED
Explain CVE-2013-1442
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Affected Products: n/a
References: [{'name': '[oss-security] 20130925 Xen Security Advisory 62 (CVE-2013-1442) - Information leak on AVX and/or LWP capable CPUs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/09/25/2'}, {'name': '1029090', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029090'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'DSA-3006', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3006'}, {'name': 'openSUSE-SU-2013:1636', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1443
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.
Affected Products: n/a
References: [{'name': 'DSA-2758', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2758'}, {'name': '[django-developers] 20130914 Set a reasonable upper bound on password length', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://python.6.x6.nabble.com/Set-a-reasonable-upper-bound-on-password-length-td5032218.html'}, {'name': 'openSUSE-SU-2013:1541', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2013/sep/15/security/'}, {'name': 'openSUSE-SU-2013:1685', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-11/msg00035.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1444
A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614'}, {'name': '97769', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/97769'}, {'name': '[oss-security] 20130925 [notification] txt2man unsafe use of tempoarary files', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q3/660'}, {'name': 'USN-1979-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1979-1'}]
CVE State: PUBLISHED