Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1803
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-97.html'}, {'name': '90714', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/90714'}, {'name': '[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/2'}, {'name': '90710', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90710'}, {'name': '[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/1'}, {'name': '90712', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90712'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php-fusion.co.uk/news.php?readmore=569'}, {'name': '90709', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90709'}, {'name': '90713', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90713'}, {'name': '90711', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90711'}, {'name': '90693', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90693'}, {'name': '90695', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90695'}, {'name': '20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/154'}, {'name': '52403', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52403'}]
CVE State: PUBLISHED
Explain CVE-2013-1804
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-97.html'}, {'name': '[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/2'}, {'name': '[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/1'}, {'name': '90707', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90707'}, {'name': '90708', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90708'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php-fusion.co.uk/news.php?readmore=569'}, {'name': '20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/154'}, {'name': '52403', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52403'}]
CVE State: PUBLISHED
Explain CVE-2013-1806
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-97.html'}, {'name': '[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/2'}, {'name': '[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/1'}, {'name': '90692', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90692'}, {'name': '90694', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90694'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php-fusion.co.uk/news.php?readmore=569'}, {'name': '90696', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90696'}, {'name': '20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/154'}]
CVE State: PUBLISHED
Explain CVE-2013-1807
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-97.html'}, {'name': '[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/2'}, {'name': '[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/1'}, {'name': '90691', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90691'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php-fusion.co.uk/news.php?readmore=569'}, {'name': '20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/154'}]
CVE State: PUBLISHED
Explain CVE-2013-1808
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb'}, {'name': '[oss-security] 20130326 Re: WordPress plugins vulnerable to CVE-2013-1808', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/26/8'}, {'name': '20130218 XSS vulnerabilities in ZeroClipboard', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/103'}, {'name': '20130220 XSS vulnerabilities in YAML, Multiproject for Trac, UserCollections for Piwigo, TAO and TableTools for DataTables for jQuery', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Feb/109'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.ru/docs29105.html'}, {'name': '[oss-security] 20130302 Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/3'}, {'name': '20130301 XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/5'}, {'name': '20130418 XSS vulnerabilities in ZeroClipboard in multiple plugins for WordPress', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Apr/87'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.ru/docs29103.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.ru/docs29104.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108'}, {'name': '[oss-security] 20130310 WordPress plugins vulnerable to CVE-2013-1808', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/10/2'}, {'name': '20130409 XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Apr/88'}, {'name': '[oss-security] 20130324 XSS vulnerabilities in ZeroClipboard and multiple web applications', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/25/1'}, {'name': '58257', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58257'}]
CVE State: PUBLISHED
Explain CVE-2013-1809
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.
Affected Products: gambas3
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1809'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1809'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-1809'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/archive/p/gambas/issues/365'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/p/gambas/code/5438/'}]
CVE State: PUBLISHED
Explain CVE-2013-1810
Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.
Affected Products: n/a
References: [{'name': '[oss-security] 20130119 CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/127'}, {'name': '[oss-security] 20130302 Re: CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/556'}, {'name': '51853', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51853'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mantisbt.org/bugs/view.php?id=15384'}]
CVE State: PUBLISHED
Explain CVE-2013-1811
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
Affected Products: mantis
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1811'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3120'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/6'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/04/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mantisbt.org/bugs/view.php?id=15258'}]
CVE State: PUBLISHED
Explain CVE-2013-1812
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=918134'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md'}, {'name': 'FEDORA-2013-20238', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openid/ruby-openid/pull/43'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed'}, {'name': 'FEDORA-2013-20260', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html'}, {'name': '[oss-security] 20130302 Re: CVE request: ruby-openid XML denial of service attack', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/03/8'}]
CVE State: PUBLISHED
Explain CVE-2013-1813
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.t-mobile.com/docs/DOC-21994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965'}, {'name': 'RHSA-2013:1732', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1732.html'}, {'name': '[busybox] 20130722 1.21.0 is released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.busybox.net/pipermail/busybox/2013-January/078864.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784'}, {'name': '20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Jun/18'}, {'name': '20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Jun/14'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html'}, {'name': '20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2020/Mar/15'}, {'name': '20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2020/Aug/20'}]
CVE State: PUBLISHED
Explain CVE-2013-1814
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Affected Products: n/a
References: [{'name': '24744', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24744/'}, {'name': '20130312 [CVE-2013-1814] Apache Rave exposes User over API', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1815
PackStack 2012.2.3 in Red Hat OpenStack Essex and Folsom can create the answer file in insecure directories such as /tmp or the current working directory, which allows local users to modify deployed systems by changing this file.
Affected Products: n/a
References: [{'name': 'packstack-answerfile-information-disclosure(83017)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83017'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917904'}, {'name': 'RHSA-2013:0671', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0671.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1816
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
Affected Products: mediawiki
References: [{'name': '58306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58306'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1816'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1816'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/88360'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-21.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/05/4'}]
CVE State: PUBLISHED
Explain CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
Affected Products: mediawiki
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1817'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1817'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58305'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-21.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/05/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/88359'}]
CVE State: PUBLISHED
Explain CVE-2013-1818
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mediawiki.org/wiki/Release_notes/1.20'}, {'name': 'mediawiki-cve20131818-info-disclosure(88363)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/88363'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.wikimedia.org/show_bug.cgi?id=45355'}, {'name': '58304', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58304'}]
CVE State: PUBLISHED
Explain CVE-2013-1819
The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.
Affected Products: n/a
References: [{'name': 'USN-1970-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1970-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=918009'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6'}, {'name': 'USN-1975-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1975-1'}, {'name': 'SUSE-SU-2013:1473', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html'}, {'name': '[oss-security] 20130305 Re: CVE request: Linux kernel: xfs: _xfs_buf_find NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/05/10'}, {'name': 'openSUSE-SU-2013:1971', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eb178619f930fa2ba2348de332a1ff1c66a31424'}, {'name': 'USN-1968-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1968-1'}, {'name': 'USN-1969-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1969-1'}, {'name': 'SUSE-SU-2013:1474', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html'}, {'name': 'USN-1973-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1973-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/eb178619f930fa2ba2348de332a1ff1c66a31424'}, {'name': 'USN-1972-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1972-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1820
tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.
Affected Products: tuned
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1820'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1820'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=918233'}]
CVE State: PUBLISHED
Explain CVE-2013-1822
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-008/'}]
CVE State: PUBLISHED
Explain CVE-2013-1823
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
Affected Products: n/a
References: [{'name': '52774', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52774'}, {'name': '91718', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/91718'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=918784'}, {'name': 'RHSA-2013:0686', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0686.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1824
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1824.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=188c196d4da60bdde9190d2fc532650d17f7af2d'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=918187'}, {'name': 'APPLE-SA-2013-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=afe98b7829d50806559acac9b530acb8283c3bf4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5880'}]
CVE State: PUBLISHED
Explain CVE-2013-1826
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.7'}, {'name': 'USN-1829-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1829-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/864745d291b5ba80ea0bd0edcbe67273de368836'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=919384'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': '[oss-security] 20130307 Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/07/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=864745d291b5ba80ea0bd0edcbe67273de368836'}]
CVE State: PUBLISHED
Explain CVE-2013-1827
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/276bdb82dedb290511467a5a4fdbe9f0b52dce6f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=919164'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=276bdb82dedb290511467a5a4fdbe9f0b52dce6f'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': '[oss-security] 20130307 Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/07/2'}]
CVE State: PUBLISHED
Explain CVE-2013-1828
The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/grsecurity/statuses/309805924749541376'}, {'name': '24747', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=919315'}, {'name': '[oss-security] 20130307 Re: CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/08/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=726bc6b092da4c093eb74d13c07184b18c1af0f1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://grsecurity.net/~spender/sctp.c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/726bc6b092da4c093eb74d13c07184b18c1af0f1'}]
CVE State: PUBLISHED
Explain CVE-2013-1829
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225339'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37338'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}]
CVE State: PUBLISHED
Explain CVE-2013-1830
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225341'}]
CVE State: PUBLISHED
Explain CVE-2013-1831
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225342'}]
CVE State: PUBLISHED
Explain CVE-2013-1832
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225343'}, {'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37681'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}]
CVE State: PUBLISHED
Explain CVE-2013-1833
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225344'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37507'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}]
CVE State: PUBLISHED
Explain CVE-2013-1834
notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225346'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37411'}]
CVE State: PUBLISHED
Explain CVE-2013-1835
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225347'}]
CVE State: PUBLISHED
Explain CVE-2013-1836
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html'}, {'name': 'FEDORA-2013-4404', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html'}, {'name': '[oss-security] 20130325 Moodle security notifications public', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/03/25/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37852'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=225348'}]
CVE State: PUBLISHED
Explain CVE-2013-1838
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.
Affected Products: n/a
References: [{'name': '[openstack] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.launchpad.net/openstack/msg21892.html'}, {'name': '58492', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58492'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/nova/+bug/1125468'}, {'name': 'USN-1771-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1771-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24453/'}, {'name': '52728', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52728'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=919648'}, {'name': '52580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52580'}, {'name': '91303', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91303'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24452/'}, {'name': 'nova-fixedips-dos(82877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82877'}, {'name': 'RHSA-2013:0709', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0709.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24451/'}, {'name': '[oss-security] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/14/18'}]
CVE State: PUBLISHED
Explain CVE-2013-1839
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.
Affected Products: n/a
References: [{'name': '58316', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58316'}, {'name': '52588', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52588'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Advisories/SQUID-2013_1.txt'}, {'name': '20130305 Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html'}, {'name': '20130307 Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-03/0069.html'}, {'name': '[oss-security] 20130311 Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/11/7'}]
CVE State: PUBLISHED
Explain CVE-2013-1840
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
Affected Products: n/a
References: [{'name': 'openstack-glance-api-info-disclosure(82878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82878'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24437/'}, {'name': 'USN-1764-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1764-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24438/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/glance/+bug/1135541'}, {'name': '52565', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52565'}, {'name': 'RHSA-2013:0707', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0707.html'}, {'name': '91304', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91304'}, {'name': '[oss-security] 20130314 [OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/14/15'}, {'name': '58490', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58490'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/24439/'}]
CVE State: PUBLISHED
Explain CVE-2013-1841
Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=920683'}, {'name': '58309', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58309'}, {'name': '[oss-security] 20130304 Reverse lookup issue in Net::Server', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/04/10'}, {'name': '[oss-security] 20130311 Re: Reverse lookup issue in Net::Server', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/12/2'}, {'name': 'netserver-cve20131841-security-bypass(82900)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82900'}]
CVE State: PUBLISHED
Explain CVE-2013-1842
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
Affected Products: n/a
References: [{'name': '[oss-security] 20130311 Re: CVE Request: typo3 sql injection and open redirection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/12/3'}, {'name': 'DSA-2646', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2646'}, {'name': '90925', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90925'}, {'name': 'openSUSE-SU-2013:0510', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html'}, {'name': '52638', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52638'}, {'name': '58330', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58330'}, {'name': '52433', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52433'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/'}]
CVE State: PUBLISHED
Explain CVE-2013-1843
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20130311 Re: CVE Request: typo3 sql injection and open redirection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/12/3'}, {'name': 'DSA-2646', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2646'}, {'name': 'openSUSE-SU-2013:0510', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html'}, {'name': '52638', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52638'}, {'name': '90924', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90924'}, {'name': '58330', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58330'}, {'name': '52433', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52433'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/'}]
CVE State: PUBLISHED
Explain CVE-2013-1844
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20130311 Re: CVE request: XSS in piwik 1.11', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/12/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwik.org/blog/2013/03/piwik-1-11/'}]
CVE State: PUBLISHED