Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1930
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
Affected Products: mantisBT
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1930'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1930'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58890'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103438.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/06/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83796'}, {'tags': ['x_refsource_MISC'], 'url': 'https://mantisbt.org/bugs/view.php?id=15453'}]
CVE State: PUBLISHED
Explain CVE-2013-1931
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
Affected Products: mantisBT
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1931'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1931'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103438.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/06/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58889'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mantisbt.org/bugs/view.php?id=15511'}]
CVE State: PUBLISHED
Explain CVE-2013-1932
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
Affected Products: mantisBT
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1932'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1932'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/06/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58893'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mantisbt.org/bugs/view.php?id=15415'}]
CVE State: PUBLISHED
Explain CVE-2013-1933
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Affected Products: n/a
References: [{'name': '92117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92117'}, {'tags': ['x_refsource_MISC'], 'url': 'http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html'}, {'name': 'karteekdocsplit-cve20131933-command-exec(83277)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83277'}, {'name': '[oss-security] 20130408 Re: Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/08/15'}]
CVE State: PUBLISHED
Explain CVE-2013-1934
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
Affected Products: mantisBT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3120'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1934'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1934'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/09/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mantisbt.org/bugs/view.php?id=15416'}]
CVE State: PUBLISHED
Explain CVE-2013-1935
A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=949981'}, {'name': 'RHSA-2013:0907', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2013-0907.html'}, {'name': 'RHSA-2013:0911', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0911.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1937
Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
Affected Products: n/a
References: [{'name': 'MDVSA-2013:144', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:144'}, {'tags': ['x_refsource_MISC'], 'url': 'http://immunityservices.blogspot.com/2019/02/cvss.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a'}, {'name': 'openSUSE-SU-2013:1065', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html'}, {'name': 'FEDORA-2013-5623', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html'}, {'name': 'FEDORA-2013-5604', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html'}, {'name': '20130409 [waraxe-2013-SA#102] - Reflected XSS in phpMyAdmin 3.5.7', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html'}, {'name': '[oss-security] 20130409 Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/04/09/13'}, {'name': 'FEDORA-2013-5620', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-102.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1938
Zimbra 2013 has XSS in aspell.php
Affected Products: Zimbra
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58913'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/09/14'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/09/15'}]
CVE State: PUBLISHED
Explain CVE-2013-1939
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-016/'}]
CVE State: PUBLISHED
Explain CVE-2013-1940
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=63353'}, {'name': 'USN-1803-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1803-1'}, {'name': 'FEDORA-2013-5883', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104089.html'}, {'name': 'openSUSE-SU-2013:0878', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00015.html'}, {'name': 'DSA-2661', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2661'}, {'name': '[oss-security] 20130418 Xorg-x11-server: Information disclosure due enabling events from hot-plug devices despite input from the device being momentarily disabled', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/18/3'}, {'name': 'FEDORA-2013-5928', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102391.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1941
The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-015/'}]
CVE State: PUBLISHED
Explain CVE-2013-1942
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
Affected Products: n/a
References: [{'name': '59030', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59030'}, {'name': '[oss-security] 20130505 Re: CVE-2013-1942 jPlayer 2.2.19 XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=136773622321563&w=2'}, {'name': '[oss-security] 20130411 CVE-2013-1942 jPlayer 2.2.19 XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=136570964825921&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.jplayer.org/2.3.0/release-notes/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-014/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e40ed6d'}, {'name': '20130421 Vulnerabilities in jPlayer', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Apr/192'}, {'name': '[oss-security] 20130429 Re: CVE-2013-1942 jPlayer 2.2.19 XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=136726705917858&w=2'}]
CVE State: PUBLISHED
Explain CVE-2013-1943
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.archive.org/web/20130329070349/http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/fa3d315a4ce2c0891cdde262562e710d95fba19e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=950490'}, {'name': 'USN-1939-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1939-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa3d315a4ce2c0891cdde262562e710d95fba19e'}]
CVE State: PUBLISHED
Explain CVE-2013-1946
The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0-alpha5 for Drupal, when page caching is enabled and anonymous users are assigned RESTWS permissions, allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type, which can "interfere with Drupal's page cache."
Affected Products: n/a
References: [{'name': '92259', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/92259'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1966758'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1966752'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1966780'}, {'name': '[oss-security] 20130412 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/12/1'}]
CVE State: PUBLISHED
Explain CVE-2013-1947
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
Affected Products: n/a
References: [{'name': '[oss-security] 20130412 Re: Remote command injection in Ruby Gem kelredd-pruview 0.3.8', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/12/2'}, {'name': '[oss-security] 20130410 Remote command injection in Ruby Gem kelredd-pruview 0.3.8', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/10/3'}]
CVE State: PUBLISHED
Explain CVE-2013-1948
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://vapid.dhs.org/advisories/md2pdf-remote-exec.html'}, {'name': '92290', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92290'}, {'name': 'md2pdf-cve20131948-command-exec(83416)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83416'}, {'name': '59061', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59061'}]
CVE State: PUBLISHED
Explain CVE-2013-1949
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/13/04/13/212226/popular-wordpress-plug-in-caught-spamming-is-put-on-probation'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityledger.com/hacked-wordpress-plug-in-put-on-double-secret-probation/'}, {'name': '[oss-security] 20130413 CVE-2013-1949 Social Media Widget remote file inclusion', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/14/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.sucuri.net/2013/04/wordpress-plugin-social-media-widget.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1950
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=948378'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb12e510f3cadd4060102c9f'}, {'name': 'RHSA-2013:0884', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0884.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1951
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.
Affected Products: MediaWiki
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1951'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1951'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-21.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-1951'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104022.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104027.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/12'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/59077'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T48084'}]
CVE State: PUBLISHED
Explain CVE-2013-1952
Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'FEDORA-2013-7432', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105533.html'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'DSA-2666', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2666'}, {'name': '59617', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59617'}, {'name': '53312', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53312'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'xen-cve20131952-dos(83968)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83968'}, {'name': '92984', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92984'}, {'name': '[oss-security] 20130502 Xen Security Advisory 49 (CVE-2013-1952) - VT-d interrupt remapping source validation flaw for bridges', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/05/02/9'}]
CVE State: PUBLISHED
Explain CVE-2013-1953
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=951257'}, {'name': '[oss-security] 20130316 Re: autotrace: stack-based buffer overflow in bmp  parser', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/3'}, {'name': 'MDVSA-2013:190', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:190'}]
CVE State: PUBLISHED
Explain CVE-2013-1954
The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.
Affected Products: n/a
References: [{'name': '[oss-security] 20130414 CVE Request: VLC Buffer Overflow in ASF Demuxer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=136593191416152&w=2'}, {'name': '59793', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59793'}, {'name': '[oss-security] 20130416 Re: CVE Request: VLC Buffer Overflow in ASF Demuxer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=136610343501731&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.videolan.org/vlc/ticket/8024'}, {'name': '57333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=b31ce523331aa3a6e620b68cdfe3f161d519631e'}, {'name': '89598', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/89598'}, {'name': 'oval:org.mitre.oval:def:17023', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.videolan.org/security/sa1302.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1955
Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm'}, {'name': '[oss-security] 20130416 Re: CVE for XSS in EasyPHPCalender script', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.easyphpcalendar.com/forums/showthread.php?p=4555'}]
CVE State: PUBLISHED
Explain CVE-2013-1956
The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3151527ee007b73a0ebd296010f1c0454a919c7d'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/3151527ee007b73a0ebd296010f1c0454a919c7d'}, {'name': '[oss-security] 20130416 Re: Re: Summary of security bugs (now fixed) in user namespaces', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6'}]
CVE State: PUBLISHED
Explain CVE-2013-1957
The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=132c94e31b8bca8ea921f9f96a57d684fa4ae0a9'}, {'name': '[oss-security] 20130416 Re: Re: Summary of security bugs (now fixed) in user namespaces', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/132c94e31b8bca8ea921f9f96a57d684fa4ae0a9'}]
CVE State: PUBLISHED
Explain CVE-2013-1958
The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=92f28d973cce45ef5823209aab3138eb45d8b349'}, {'name': '[oss-security] 20130416 Re: Re: Summary of security bugs (now fixed) in user namespaces', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/92f28d973cce45ef5823209aab3138eb45d8b349'}]
CVE State: PUBLISHED
Explain CVE-2013-1959
kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/e3211c120a85b792978bcb4be7b2886df18d27f0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/6708075f104c3c9b04b23336bb0366ca30c3931b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6708075f104c3c9b04b23336bb0366ca30c3931b'}, {'name': '[oss-security] 20130428 Multiple Linux setuid output redirection vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/29/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9'}, {'name': '25307', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/25307'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e3211c120a85b792978bcb4be7b2886df18d27f0'}]
CVE State: PUBLISHED
Explain CVE-2013-1960
Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file.
Affected Products: n/a
References: [{'name': '53237', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53237'}, {'name': 'FEDORA-2013-7369', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105253.html'}, {'name': 'DSA-2698', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2698'}, {'name': '59609', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59609'}, {'name': '53765', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53765'}, {'name': 'openSUSE-SU-2013:0944', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00080.html'}, {'name': 'RHSA-2014:0223', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0223.html'}, {'name': '[oss-security] 20130502 Fwd: Two libtiff (tiff2pdf flaws)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q2/254'}, {'name': 'FEDORA-2013-7361', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105828.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=952158'}, {'name': 'openSUSE-SU-2013:0922', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00058.html'}, {'name': 'FEDORA-2013-7339', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104916.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1961
Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.
Affected Products: n/a
References: [{'name': '53237', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53237'}, {'name': 'FEDORA-2013-7369', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105253.html'}, {'name': 'DSA-2698', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2698'}, {'name': '53765', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53765'}, {'name': 'openSUSE-SU-2013:0944', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00080.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=952131'}, {'name': 'RHSA-2014:0223', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0223.html'}, {'name': '[oss-security] 20130502 Fwd: Two libtiff (tiff2pdf flaws)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q2/254'}, {'name': 'FEDORA-2013-7361', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105828.html'}, {'name': '59607', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59607'}, {'name': 'openSUSE-SU-2013:0922', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00058.html'}, {'name': 'FEDORA-2013-7339', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104916.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1962
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
Affected Products: n/a
References: [{'name': 'FEDORA-2013-8635', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739'}, {'name': '[oss-security] 20130516 CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/05/16/9'}, {'name': 'FEDORA-2013-8681', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.html'}, {'name': '93451', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/93451'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=953107'}, {'name': 'USN-1895-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1895-1'}, {'name': '59937', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59937'}, {'name': '53475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53475'}, {'name': '53440', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53440'}, {'name': 'RHSA-2013:0831', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0831.html'}, {'name': '1028577', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028577'}, {'name': 'openSUSE-SU-2013:0885', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00022.html'}, {'name': 'libvirt-cve20131962-dos(84341)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/84341'}, {'name': '[libvir-list] 20130516 [libvirt] [PATCH] daemon: fix leak after listing all volumes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1963
The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-018/'}]
CVE State: PUBLISHED
Explain CVE-2013-1964
Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors.
Affected Products: n/a
References: [{'name': '59293', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59293'}, {'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': '[oss-security] 20130418 Xen Security Advisory 50 (CVE-2013-1964) - grant table hypercall acquire/release imbalance', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/18/9'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'DSA-2666', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2666'}, {'name': '1028459', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028459'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'FEDORA-2013-6723', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1965
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/development/2.x/docs/s2-012.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=967655'}, {'name': '60082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/60082'}]
CVE State: PUBLISHED
Explain CVE-2013-1966
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Affected Products: n/a
References: [{'name': '60166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/60166'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=967656'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/development/2.x/docs/s2-013.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://cwiki.apache.org/confluence/display/WW/S2-013'}]
CVE State: PUBLISHED
Explain CVE-2013-1967
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Affected Products: n/a
References: [{'name': 'mediaelementjs-flashmediaelement-xss(83647)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83647'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/johndyer/mediaelement/commit/9223dc6bfc50251a9a3cba0210e71be80fc38ecd'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=955307'}, {'name': '[oss-security] 20130417 Fwd: Re: CVE Request: ownCloud 5.0.5 and 4.5.10', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q2/111'}, {'name': '53079', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53079'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-017'}, {'name': '[oss-security] 20130421 ownCloud Security Advisories (2013-017, 2013-018)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q2/133'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/johndyer/mediaelement/tree/2.11.1'}]
CVE State: PUBLISHED
Explain CVE-2013-1968
Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.
Affected Products: n/a
References: [{'name': '[subversion-announce] 20130531 Subversion 1.6.23 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E'}, {'name': '[subversion-announce] 20130531 Apache Subversion 1.7.10 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E'}, {'name': 'RHSA-2014:0255', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0255.html'}, {'name': 'USN-1893-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1893-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://subversion.apache.org/security/CVE-2013-1968-advisory.txt'}, {'name': 'DSA-2703', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2703'}, {'name': 'oval:org.mitre.oval:def:18986', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18986'}, {'name': 'openSUSE-SU-2013:1139', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1969
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/libxml2/commit/?id=de0cc20c29cb3f056062925395e0f68d2250a46f'}, {'name': 'openSUSE-SU-2013:0729', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00109.html'}, {'name': 'openSUSE-SU-2013:0945', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00081.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=690202'}, {'name': 'USN-1817-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1817-1'}, {'name': '[oss-security] 20130417 CVE request : libxml2 Multiple Use-After-Free Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/17/4'}, {'name': '53061', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53061'}, {'name': '[oss-security] 20130418 Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/19/1'}]
CVE State: PUBLISHED
Explain CVE-2013-1971
Cross-site scripting (XSS) vulnerability in the MP3 Player module for Drupal 6.x allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the file name of a MP3 file.
Affected Products: n/a
References: [{'name': 'drupal-mp3player-filename-xss(83649)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83649'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1972804'}, {'name': '59276', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59276'}]
CVE State: PUBLISHED
Explain CVE-2013-1972
Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create, modify, or delete files via unknown vectors.
Affected Products: n/a
References: [{'name': '20130417 [Security-news] SA-CONTRIB-2013-044 - elFinder file manager - Cross Site Request Forgery (CSRF)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0237.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1972942'}, {'name': 'drupal-elfinderfilemanager-unspecified-csrf(83651)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83651'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1972084'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1972082'}, {'name': '92533', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92533'}]
CVE State: PUBLISHED
Explain CVE-2013-1973
The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors.
Affected Products: n/a
References: [{'name': '52996', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52996'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1971848'}, {'name': '92532', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92532'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1972976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1971856'}]
CVE State: PUBLISHED
Explain CVE-2013-1976
The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0871', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0871.html'}, {'name': 'RHSA-2013:0869', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0869.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=927622'}, {'name': 'RHSA-2013:0870', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0870.html'}, {'name': 'RHSA-2013:0872', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0872.html'}, {'name': 'openSUSE-SU-2013:1306', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1977
OpenStack devstack uses world-readable permissions for keystone.conf, which allows local users to obtain sensitive information such as the LDAP password and admin_token secret by reading the file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/devstack/+bug/1168252'}, {'name': '[oss-security] 20130423 Re: CVE-2013-1977 - OpenStack keystone.conf insecure file permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/23/7'}, {'name': '[oss-security] 20130419 CVE-2013-1977 - OpenStack keystone.conf insecure file permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/19/2'}]
CVE State: PUBLISHED
Explain CVE-2013-1978
Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries.
Affected Products: n/a
References: [{'name': '64098', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64098'}, {'name': 'RHSA-2013:1778', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1778.html'}, {'name': 'GLSA-201603-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=953902'}, {'name': 'DSA-2813', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2813'}, {'name': 'USN-2051-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2051-1'}]
CVE State: PUBLISHED