Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1888
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Affected Products: n/a
References: [{'name': '[oss-security] 20130322 Re: CVE Request: python-pip insecure temporary directory handling', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/22/10'}, {'name': 'FEDORA-2013-8221', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105989.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pypa/pip/pull/734/files'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pypa/pip/pull/780/files'}, {'name': 'FEDORA-2013-8193', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pypa/pip/issues/725'}, {'name': 'FEDORA-2013-8166', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106311.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1889
mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out of the chroot.
Affected Products: libapache2-mod-ruid2
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1889'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/23/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/p/mod-ruid/mailman/mod-ruid-announce/thread/514C503E.4020109%40users.sourceforge.net/'}]
CVE State: PUBLISHED
Explain CVE-2013-1890
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/.
Affected Products: n/a
References: [{'name': 'owncloud-cve20131890-multiple-xss(83245)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83245'}, {'name': '58852', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58852'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-011'}]
CVE State: PUBLISHED
Explain CVE-2013-1891
In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.
Affected Products: opencart
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-98.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://seclists.org/fulldisclosure/2013/Mar/176'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.openwall.com/lists/oss-security/2013/03/24/1'}]
CVE State: PUBLISHED
Explain CVE-2013-1892
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
Affected Products: n/a
References: [{'name': 'RHSA-2013:1170', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1170.html'}, {'name': '24947', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24947'}, {'name': '[oss-security] 20130325 Re: CVE Request: Mongo DB', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/25/9'}, {'name': 'FEDORA-2013-4539', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101630.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/'}, {'name': '24935', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24935'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.mongodb.org/browse/SERVER-9124'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mongodb.org/about/alerts/'}, {'name': 'FEDORA-2013-4531', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101679.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1893
SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to the contacts application.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-012'}, {'name': '58855', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58855'}, {'name': 'owncloud-addressbookprovider-sql-injection(83253)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83253'}]
CVE State: PUBLISHED
Explain CVE-2013-1895
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Affected Products: py-bcrypt
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/26/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58702'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83039'}]
CVE State: PUBLISHED
Explain CVE-2013-1897
The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-4578', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101323.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=928105'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/freeipa/ticket/3540'}, {'name': 'RHSA-2013:0742', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0742.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/389/ticket/47308'}]
CVE State: PUBLISHED
Explain CVE-2013-1898
lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html'}, {'name': '20130326 Ruby gem Thumbshooter 0.1.5 remote command\texecution', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/218'}, {'name': '91839', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91839'}, {'name': '[oss-security] 20130326 Ruby gem Thumbshooter 0.1.5 remote code execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/26/3'}, {'name': '[oss-security] 20130326 Re: Ruby gem Thumbshooter 0.1.5 remote code execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/26/13'}]
CVE State: PUBLISHED
Explain CVE-2013-1899
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/current/static/release-9-2-4.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1456/'}, {'name': 'openSUSE-SU-2013:0628', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html'}, {'name': 'openSUSE-SU-2013:0635', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/support/security/faq/2013-04-04/'}, {'name': 'MDVSA-2013:142', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:142'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5892'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/current/static/release-9-0-13.html'}, {'name': 'USN-1789-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1789-1'}, {'name': 'APPLE-SA-2013-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html'}, {'name': 'FEDORA-2013-6148', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html'}, {'name': 'APPLE-SA-2013-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/current/static/release-9-1-9.html'}, {'name': 'SUSE-SU-2013:0633', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html'}, {'name': 'DSA-2658', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2658'}, {'name': 'openSUSE-SU-2013:0627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html'}, {'name': 'FEDORA-2013-5000', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5880'}]
CVE State: PUBLISHED
Explain CVE-2013-1901
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/current/static/release-9-2-4.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1456/'}, {'name': 'openSUSE-SU-2013:0628', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html'}, {'name': 'openSUSE-SU-2013:0635', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html'}, {'name': 'MDVSA-2013:142', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:142'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5892'}, {'name': 'USN-1789-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1789-1'}, {'name': 'APPLE-SA-2013-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html'}, {'name': 'FEDORA-2013-6148', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html'}, {'name': 'APPLE-SA-2013-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/current/static/release-9-1-9.html'}, {'name': 'SUSE-SU-2013:0633', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html'}, {'name': 'DSA-2658', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2658'}, {'name': 'openSUSE-SU-2013:0627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html'}, {'name': 'FEDORA-2013-5000', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5880'}]
CVE State: PUBLISHED
Explain CVE-2013-1902
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1456/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/support/security/'}]
CVE State: PUBLISHED
Explain CVE-2013-1903
PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1456/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/support/security/'}]
CVE State: PUBLISHED
Explain CVE-2013-1904
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://habrahabr.ru/post/174423/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/'}, {'name': '[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.roundcube.net/pipermail/dev/2013-March/022328.html'}, {'name': 'openSUSE-SU-2013:0671', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html'}, {'name': '[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/28/8'}]
CVE State: PUBLISHED
Explain CVE-2013-1905
Cross-site scripting (XSS) vulnerability in the Zero Point theme 7.x-1.x before 7.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '20130327 [Security-news] SA-CONTRIB-2013-036 - Zero Point - Cross Site Scripting (XSS)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/241'}, {'name': '52775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52775'}, {'name': '91745', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91745'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1954588'}, {'name': '58758', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58758'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120985/Drupal-Zero-Point-7.x-Cross-Site-Scripting.html'}, {'name': 'zeropoint-unspecified-xss(83137)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1953840'}]
CVE State: PUBLISHED
Explain CVE-2013-1906
Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1954592'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1954508'}, {'name': '52768', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52768'}]
CVE State: PUBLISHED
Explain CVE-2013-1907
The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120991/Drupal-Common-Groups-7.x-Access-Bypass-Privilege-Escalation.html'}, {'name': '20130327 [Security-news] SA-CONTRIB-2013-038 - Commons Groups - Access bypass & Privilege escalation', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/242'}, {'name': '52795', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52795'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1954764'}, {'name': '52769', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52769'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1954948'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1954762'}, {'name': '91748', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91748'}, {'name': 'drupal-commons-groups-security-bypass(83133)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83133'}]
CVE State: PUBLISHED
Explain CVE-2013-1908
The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html'}, {'name': '20130327 [Security-news] SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Mar/244'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1954768'}, {'name': '52795', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52795'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1954766'}, {'name': '52766', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52766'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1954948'}, {'name': '91747', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91747'}]
CVE State: PUBLISHED
Explain CVE-2013-1909
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Products: n/a
References: [{'name': '53968', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53968'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?view=revision&revision=1460013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/QPID-4918'}, {'name': 'RHSA-2013:1024', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1024.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://qpid.apache.org/releases/qpid-0.22/release-notes.html'}, {'name': '54137', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54137'}]
CVE State: PUBLISHED
Explain CVE-2013-1910
yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.
Affected Products: yum
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1910'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1910'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-1910'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58533'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/29/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83348'}]
CVE State: PUBLISHED
Explain CVE-2013-1911
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html'}, {'name': '58783', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58783'}, {'name': '20130401 Remote command execution in Ruby Gem ldoce 0.0.2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html'}, {'name': 'rubygem-cve20131911-command-exec(83163)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83163'}, {'name': '[oss-security] 20130331 Re: Remote command execution in Ruby Gem ldoce 0.0.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/31/3'}, {'name': '91870', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91870'}]
CVE State: PUBLISHED
Explain CVE-2013-1912
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-6253', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103794.html'}, {'name': 'RHSA-2013:0868', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0868.html'}, {'name': '52725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52725'}, {'name': 'FEDORA-2013-4807', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103730.html'}, {'name': 'DSA-2711', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2711'}, {'name': 'FEDORA-2013-4827', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103770.html'}, {'name': '58820', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58820'}, {'name': 'USN-1800-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1800-1'}, {'name': '[oss-security] 20130403 CVE-2013-1912 : haproxy may crash on TCP content inspection rules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/03/1'}, {'name': 'RHSA-2013:0729', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0729.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1913
Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries value in an X Window System (XWD) image dump.
Affected Products: n/a
References: [{'name': '64105', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64105'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=947868'}, {'name': 'RHSA-2013:1778', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1778.html'}, {'name': 'GLSA-201603-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-01'}, {'name': 'DSA-2813', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2813'}, {'name': 'USN-2051-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2051-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1915
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:1342', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe'}, {'name': 'openSUSE-SU-2013:1331', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html'}, {'name': '[oss-security] 20130403 Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable  to XXE attacks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/03/7'}, {'name': '58810', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58810'}, {'name': 'FEDORA-2013-4831', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html'}, {'name': 'MDVSA-2013:156', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:156'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=947842'}, {'name': 'FEDORA-2013-4834', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES'}, {'name': 'FEDORA-2013-4908', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html'}, {'name': '52977', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52977'}, {'name': '52847', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52847'}, {'name': 'DSA-2659', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2659'}, {'name': 'openSUSE-SU-2013:1336', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1916
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Affected Products: WordPress Plugin User Photo
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/user-photo/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/347137'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/16181'}]
CVE State: PUBLISHED
Explain CVE-2013-1917
Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0470', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html'}, {'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': '1028455', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028455'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'openSUSE-SU-2013:0912', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00049.html'}, {'name': '[oss-security] 20130418 Xen Security Advisory 44 (CVE-2013-1917) - Xen PV DoS vulnerability with SYSENTER', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/18/8'}, {'name': 'DSA-2662', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2662'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'FEDORA-2013-6723', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html'}, {'name': 'SUSE-SU-2014:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1918
Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'FEDORA-2013-7432', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105533.html'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': '53187', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53187'}, {'name': 'DSA-2666', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2666'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20130502 Xen Security Advisory 45 (CVE-2013-1918) - Several long latency operations are not preemptible', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/05/02/8'}, {'name': '59615', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59615'}]
CVE State: PUBLISHED
Explain CVE-2013-1919
Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'openSUSE-SU-2013:0912', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00049.html'}, {'name': 'DSA-2662', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2662'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'FEDORA-2013-6723', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html'}, {'name': '[oss-security] 20130418 Xen Security Advisory 46 (CVE-2013-1919) - Several access permission issues with IRQs for unprivileged guests', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/18/6'}, {'name': '59292', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59292'}, {'name': 'FEDORA-2013-6641', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104538.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1920
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0470', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html'}, {'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': '[Xen-announce] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.xen.org/archives/html/xen-announce/2013-04/msg00000.html'}, {'name': '92050', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/92050'}, {'name': 'xen-cve20131920-code-exec(83226)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83226'}, {'name': 'openSUSE-SU-2013:0912', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00049.html'}, {'name': '52857', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52857'}, {'name': '58880', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58880'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': 'SUSE-SU-2014:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html'}, {'name': '1028388', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028388'}, {'name': '[oss-security] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/04/7'}]
CVE State: PUBLISHED
Explain CVE-2013-1921
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0029', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0029.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=948106'}, {'name': 'RHSA-2013:1209', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1209.html'}, {'name': 'RHSA-2013:1437', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1437.html'}, {'name': 'RHSA-2013:1207', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1207.html'}, {'name': 'RHSA-2013:1208', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1208.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1922
qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-6221', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103637.html'}, {'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'FEDORA-2013-6185', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103621.html'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'FEDORA-2013-6211', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104036.html'}, {'name': '[oss-security] 20130416 CVE-2013-1922 -- qemu: qemu-nbd block format auto-detection vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/16/2'}, {'name': '1028426', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028426'}, {'name': '[oss-security] 20130415 Xen Security Advisory 48 (CVE-2013-1922) - qemu-nbd format-guessing due to missing format specification', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/15/3'}]
CVE State: PUBLISHED
Explain CVE-2013-1923
rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.
Affected Products: n/a
References: [{'name': '58854', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58854'}, {'name': '[linux-nfs] 20130403 Re: [PATCH] Avoid PTR lookups when possible', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-nfs&m=136500502805121&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=948072'}, {'name': 'openSUSE-SU-2013:1048', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00172.html'}, {'name': 'openSUSE-SU-2013:1012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00142.html'}, {'name': 'openSUSE-SU-2013:1016', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00146.html'}, {'name': 'nfsutils-cve20131923-spoofing(85331)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/85331'}, {'name': '[linux-nfs] 20130402 Re: [PATCH] Avoid PTR lookups when possible', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-nfs&m=136491998607561&w=2'}]
CVE State: PUBLISHED
Explain CVE-2013-1924
Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2
Affected Products: Commerce Skrill
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/04/6'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1960338'}]
CVE State: PUBLISHED
Explain CVE-2013-1925
The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/121072/Drupal-Chaos-Tool-Suite-7.x-Access-Bypass.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1960406'}, {'name': '91986', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/91986'}, {'name': 'drupal-chaostool-node-security-bypass(83254)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83254'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1960424'}, {'name': '20130403 [Security-news] SA-CONTRIB-2013-041 - Chaos tool suite (ctools) - Access bypass', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Apr/8'}]
CVE State: PUBLISHED
Explain CVE-2013-1928
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0847', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/12176503366885edd542389eed3aaf94be163fdb'}, {'name': '[oss-security] 20130405 Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/06/2'}, {'name': 'SUSE-SU-2013:0856', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html'}, {'name': 'USN-1829-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1829-1'}, {'name': '[oss-security] 20130409 Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/09/6'}, {'name': 'RHSA-2013:1645', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1645.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=949567'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=12176503366885edd542389eed3aaf94be163fdb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.5'}]
CVE State: PUBLISHED
Explain CVE-2013-1929
Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
Affected Products: n/a
References: [{'name': 'USN-1834-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1834-1'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=949932'}, {'name': 'SUSE-SU-2013:1473', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html'}, {'name': 'RHSA-2013:1645', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1645.html'}, {'name': 'USN-1835-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1835-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf'}, {'name': 'USN-1838-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1838-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=715230a44310a8cf66fbfb5a46f9a62a9b2de424'}, {'name': 'openSUSE-SU-2013:1971', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html'}, {'name': 'USN-1836-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1836-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/715230a44310a8cf66fbfb5a46f9a62a9b2de424'}, {'name': 'SUSE-SU-2013:1474', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6'}, {'name': 'FEDORA-2013-5368', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101836.html'}, {'name': '[oss-security] 20130405 Re: CVE Request: tg3 VPD firmware -> driver injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/06/3'}]
CVE State: PUBLISHED