Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1039
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1040
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1041
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1042
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1043
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1044
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1045
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1046
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1047
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': '1029054', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'APPLE-SA-2013-10-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1048
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz'}, {'name': 'DSA-2637', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2637'}]
CVE State: PUBLISHED
Explain CVE-2013-1049
Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.
Affected Products: n/a
References: [{'name': 'DSA-2635', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2635'}, {'name': '90747', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90747'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/cfingerd/+bug/1104425'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700098'}]
CVE State: PUBLISHED
Explain CVE-2013-1050
The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, which prevents the program from starting automatically after login and allows physically proximate attackers to bypass screen locking and access an unattended workstation.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1120126'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=683060'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.gnome.org/browse/gnome-screensaver/commit/?id=1940dc6bc8ad5ee2c029714efb1276c05ca80bd4'}, {'name': 'USN-1716-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1716-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1051
apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.
Affected Products: n/a
References: [{'name': '91428', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91428'}, {'name': 'USN-1762-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1762-1'}, {'name': '52633', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52633'}]
CVE State: PUBLISHED
Explain CVE-2013-1052
pam-xdg-support, as used in Ubuntu 12.10, does not properly handle the PATH environment variable, which allows local users to gain privileges via unspecified vectors related to sudo.
Affected Products: n/a
References: [{'name': '58550', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58550'}, {'name': 'USN-1766-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1766-1'}, {'name': 'ubuntu-cve20131052-priv-esc(82918)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82918'}]
CVE State: PUBLISHED
Explain CVE-2013-1053
In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to recover usernames and passwords from the file. This issue affects version 1.0.0-0ubuntu3 and prior versions.
Affected Products: remote-login-service
References: [{'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://launchpad.net/bugs/1158373'}]
CVE State: PUBLISHED
Explain CVE-2013-1054
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.
Affected Products: unity-firefox-extension
References: [{'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://launchpad.net/bugs/1175661'}, {'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://ubuntu.com/USN-2743-3'}]
CVE State: PUBLISHED
Explain CVE-2013-1055
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.
Affected Products: unity-firefox-extension
References: [{'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://ubuntu.com/USN-2743-3'}, {'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://launchpad.net/bugs/1175691'}]
CVE State: PUBLISHED
Explain CVE-2013-1056
X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.
Affected Products: n/a
References: [{'name': 'USN-1990-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1990-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1057
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory.
Affected Products: n/a
References: [{'name': 'USN-2013-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-2013-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/maas/+bug/1158425'}, {'name': '55567', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55567'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/maas/+milestone/13.10'}]
CVE State: PUBLISHED
Explain CVE-2013-1058
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.
Affected Products: n/a
References: [{'name': 'USN-2013-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2013-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/maas/%2Bbug/1039513'}, {'name': '55567', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55567'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/maas/+milestone/13.10'}]
CVE State: PUBLISHED
Explain CVE-2013-1059
net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.
Affected Products: n/a
References: [{'name': '[oss-security] 20130709 Linux kernel libceph NULL function pointer dereference (CVE-2013-1059)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/07/09/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hkpco.kr/advisory/CVE-2013-1059.txt'}, {'name': 'SUSE-SU-2013:1473', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=767633&action=diff'}, {'name': 'SUSE-SU-2013:1161', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00012.html'}, {'name': 'openSUSE-SU-2013:1971', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html'}, {'name': 'SUSE-SU-2013:1474', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=977356'}, {'name': 'USN-1941-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1941-1'}, {'name': 'USN-1942-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1942-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1060
A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.
Affected Products: n/a
References: [{'name': 'USN-1943-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1943-1'}, {'name': 'USN-1938-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1938-1'}, {'name': 'USN-1944-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1944-1'}, {'name': 'USN-1945-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1945-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/1206200'}, {'name': '[kernel-team] 20130731 [CVE-2013-1060] perf configuration file vunerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.ubuntu.com/archives/kernel-team/2013-July/031248.html'}, {'name': 'USN-1939-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1939-1'}, {'name': '[kernel-team] 20130731 [lucid CVE 1/1] UBUNTU: [Packaging] supply perf with appropriate prefix to ensure use of local config', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.ubuntu.com/archives/kernel-team/2013-July/031249.html'}, {'name': 'USN-1947-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1947-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1060.html'}, {'name': 'USN-1941-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1941-1'}, {'name': 'USN-1942-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1942-1'}, {'name': 'USN-1946-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1946-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1061
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/software-properties/0.82.7.5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://launchpadlibrarian.net/150156695/software-properties_0.92.17.2_0.92.17.3.diff.gz'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/software-properties/0.92.17.3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/software-properties/0.92.9.3'}, {'name': '54909', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54909'}, {'name': 'softwareproperties-cve20131061-sec-bypass(87381)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/87381'}, {'name': 'USN-1960-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1960-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1062
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'name': 'USN-1962-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1962-1'}, {'name': '54907', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54907'}]
CVE State: PUBLISHED
Explain CVE-2013-1063
usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'name': 'USN-1963-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1963-1'}, {'name': '54901', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/usb-creator/0.2.40ubuntu2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/usb-creator/0.2.47.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/usb-creator/0.2.38.2'}]
CVE State: PUBLISHED
Explain CVE-2013-1064
apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu7.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/apt-xapian-index/0.45ubuntu2.1'}, {'name': 'USN-1955-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1955-1'}, {'name': '54914', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54914'}]
CVE State: PUBLISHED
Explain CVE-2013-1065
backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'name': '54912', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54912'}, {'name': 'USN-1957-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1957-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/jockey/0.9.7-0ubuntu7.11'}]
CVE State: PUBLISHED
Explain CVE-2013-1066
language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/language-selector/0.90.1'}, {'name': 'languageselector-cve20131066-sec-bypass(87379)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/87379'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/language-selector/0.110.1'}, {'name': 'USN-1958-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1958-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/language-selector/0.79.4'}, {'name': '54911', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54911'}]
CVE State: PUBLISHED
Explain CVE-2013-1067
Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file.
Affected Products: n/a
References: [{'name': 'USN-2007-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2007-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1068
The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.
Affected Products: n/a
References: [{'name': 'USN-2248-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-2248-1'}, {'name': 'USN-2247-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2247-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1069
Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file.
Affected Products: n/a
References: [{'name': 'USN-2105-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2105-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/maas/%2Bbug/1254034'}]
CVE State: PUBLISHED
Explain CVE-2013-1070
Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.
Affected Products: n/a
References: [{'name': '65575', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65575'}, {'name': 'USN-2105-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2105-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/maas/%2Bbug/1251336'}]
CVE State: PUBLISHED
Explain CVE-2013-1079
Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-13-048/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011811'}]
CVE State: PUBLISHED
Explain CVE-2013-1080
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011812'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-13-049/'}, {'name': '24938', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24938'}]
CVE State: PUBLISHED
Explain CVE-2013-1081
Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011895'}]
CVE State: PUBLISHED
Explain CVE-2013-1082
Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011896'}]
CVE State: PUBLISHED
Explain CVE-2013-1083
Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager (aka IDM) Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=nbGXg-msbmw~'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=807193'}]
CVE State: PUBLISHED
Explain CVE-2013-1084
Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012760'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'name': '55450', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55450'}]
CVE State: PUBLISHED
Explain CVE-2013-1085
Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier, and Novell Messenger 2.1.x and 2.2.x before 2.2.2, allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-13-036/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011935'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=777352'}]
CVE State: PUBLISHED
Explain CVE-2013-1086
Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012064'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=802906'}, {'name': '53098', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53098'}]
CVE State: PUBLISHED
Explain CVE-2013-1087
Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=799673'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012063'}]
CVE State: PUBLISHED
Explain CVE-2013-1088
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7010166'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=726260'}]
CVE State: PUBLISHED
Explain CVE-2013-1090
The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=811369'}, {'name': 'openSUSE-SU-2013:1826', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00025.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1091
Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '59612', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012344'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=800593'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=k6yH0sy992E~'}]
CVE State: PUBLISHED
Explain CVE-2013-1092
Multiple unquoted Windows search path vulnerabilities in Novell ZENworks Desktop Management (ZDM) 7 through 7.1 might allow local users to gain privileges via a Trojan horse "program" file in the C: folder, related to an attempted launch of (1) ZenRem32.exe or (2) wm.exe.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=hT-LlTRPOfw~'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012147'}]
CVE State: PUBLISHED
Explain CVE-2013-1093
Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012025'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012499'}]
CVE State: PUBLISHED
Explain CVE-2013-1094
Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012501'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012025'}]
CVE State: PUBLISHED
Explain CVE-2013-1095
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012500'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012025'}]
CVE State: PUBLISHED
Explain CVE-2013-1096
Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.
Affected Products: n/a
References: [{'name': '1029532', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029532'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=819115'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=dnDbmYe8PZc~'}]
CVE State: PUBLISHED
Explain CVE-2013-1097
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onload event.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012025'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7012502'}]
CVE State: PUBLISHED
Explain CVE-2013-1100
The HTTP server in Cisco IOS on Catalyst switches does not properly handle TCP socket events, which allows remote attackers to cause a denial of service (device crash) via crafted packets on TCP port (1) 80 or (2) 443, aka Bug ID CSCuc53853.
Affected Products: n/a
References: [{'name': '20130130 Cisco IOS Software HTTP Server Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1100'}]
CVE State: PUBLISHED
Explain CVE-2013-1102
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, 7.1 and 7.2 before 7.2.110.0, and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets, aka Bug ID CSCtx80743.
Affected Products: n/a
References: [{'name': '51965', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51965'}, {'name': '57524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57524'}, {'name': '20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc'}, {'name': '1028027', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028027'}]
CVE State: PUBLISHED
Explain CVE-2013-1103
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (Access Point reload) via crafted SIP packets, aka Bug ID CSCts87659.
Affected Products: n/a
References: [{'name': '51965', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51965'}, {'name': '57524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57524'}, {'name': '89530', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89530'}, {'name': '20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc'}, {'name': '1028027', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028027'}]
CVE State: PUBLISHED
Explain CVE-2013-1104
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636.
Affected Products: n/a
References: [{'name': '89533', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89533'}, {'name': '51965', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51965'}, {'name': '57524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57524'}, {'name': '20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc'}, {'name': '1028027', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028027'}, {'name': 'cisco-wlc-profiling-code-exec(81489)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81489'}]
CVE State: PUBLISHED
Explain CVE-2013-1105
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653.
Affected Products: n/a
References: [{'name': '89532', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89532'}, {'name': '51965', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51965'}, {'name': 'cisco-wlc-unauth-access(81490)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81490'}, {'name': '57524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57524'}, {'name': '20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc'}, {'name': '1028027', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028027'}]
CVE State: PUBLISHED
Explain CVE-2013-1107
The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
Affected Products: n/a
References: [{'name': '20130113 Cisco Webex Social Information Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1107'}]
CVE State: PUBLISHED
Explain CVE-2013-1108
Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.
Affected Products: n/a
References: [{'name': '20130115 Cisco WebEx Cancel Hands-on Lab Session Reservation', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1108'}, {'name': '1028014', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028014'}]
CVE State: PUBLISHED
Explain CVE-2013-1109
Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067.
Affected Products: n/a
References: [{'name': '20130114 Cross-Site Request Forgery Vulnerability in testingLibraryAction.do', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1109'}, {'name': '1028016', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028016'}]
CVE State: PUBLISHED
Explain CVE-2013-1110
Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065.
Affected Products: n/a
References: [{'name': '20130116 Cisco WebEx Enable/Disable Availability of Recordings', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1110'}, {'name': '1028013', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028013'}, {'name': '57488', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57488'}]
CVE State: PUBLISHED