Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-0213
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2013-0213'}, {'name': 'SUSE-SU-2013:0326', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html'}, {'name': 'openSUSE-SU-2013:0281', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html'}, {'name': '57631', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57631'}, {'name': 'openSUSE-SU-2013:0277', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html'}, {'name': 'SUSE-SU-2013:0519', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993'}, {'name': 'RHSA-2014:0305', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0305.html'}, {'name': 'USN-2922-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2922-1'}, {'name': 'DSA-2617', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2617'}, {'name': 'RHSA-2013:1310', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1310.html'}, {'name': 'RHSA-2013:1542', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1542.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0214
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0326', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html'}, {'name': '89627', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89627'}, {'name': 'openSUSE-SU-2013:0281', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html'}, {'name': '57631', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57631'}, {'name': 'openSUSE-SU-2013:0277', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2013-0214'}, {'name': 'SUSE-SU-2013:0519', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993'}, {'name': 'RHSA-2014:0305', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0305.html'}, {'name': 'USN-2922-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2922-1'}, {'name': 'DSA-2617', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2617'}, {'name': 'RHSA-2013:1310', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1310.html'}, {'name': 'RHSA-2013:1542', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1542.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0215
oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=40f9c5e0a6d15b4ca1f6d4ed3a46f0871520eab5'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': '[oss-security] 20130205 Xen Security Advisory 38 (CVE-2013-0215) - oxenstored incorrect handling of certain Xenbus ring states', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/05/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=61401264eb00fae4ee4efc8e9a5067449283207b'}]
CVE State: PUBLISHED
Explain CVE-2013-0216
The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.
Affected Products: n/a
References: [{'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=910883'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/48856286b64e4b66ec62b94e504d0b29c1ade664'}, {'name': 'openSUSE-SU-2013:0395', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=48856286b64e4b66ec62b94e504d0b29c1ade664'}, {'name': 'SUSE-SU-2013:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'name': '[oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/12'}]
CVE State: PUBLISHED
Explain CVE-2013-0217
Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
Affected Products: n/a
References: [{'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=910883'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d5145d8eb2b9791533ffe4dc003b129b9696c48'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/7d5145d8eb2b9791533ffe4dc003b129b9696c48'}, {'name': '[oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/12'}]
CVE State: PUBLISHED
Explain CVE-2013-0218
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0206', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0206.html'}, {'name': '89698', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/89698'}, {'name': '52041', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52041'}, {'name': 'RHSA-2013:0833', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0833.html'}, {'name': 'RHSA-2013:0207', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0207.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=903073'}, {'name': 'jboss-eap-info-disc(81725)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81725'}, {'name': '57652', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57652'}]
CVE State: PUBLISHED
Explain CVE-2013-0219
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4'}, {'name': '51928', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51928'}, {'name': 'FEDORA-2013-1795', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html'}, {'name': 'RHSA-2013:0508', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0508.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a'}, {'name': 'RHSA-2013:1319', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1319.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047'}, {'name': '52315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/sssd/ticket/1782'}, {'name': '57539', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57539'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=884254'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37'}, {'name': 'FEDORA-2013-1826', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0220
The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/sssd/ticket/1781'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4'}, {'name': '51928', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51928'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab'}, {'name': 'FEDORA-2013-1795', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html'}, {'name': 'RHSA-2013:0508', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0508.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=884601'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325'}, {'name': '52315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52315'}, {'name': '57539', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57539'}, {'name': 'FEDORA-2013-1826', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0221
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=903464'}, {'name': 'RHSA-2013:1652', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1652.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=798538'}]
CVE State: PUBLISHED
Explain CVE-2013-0222
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=903465'}, {'name': 'RHSA-2013:1652', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1652.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=796243'}]
CVE State: PUBLISHED
Explain CVE-2013-0223
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.
Affected Products: n/a
References: [{'name': 'RHSA-2013:1652', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1652.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=798541'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=903466'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19'}]
CVE State: PUBLISHED
Explain CVE-2013-0224
The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1896714'}, {'name': '[oss-security] 20130124 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/25/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1895234'}]
CVE State: PUBLISHED
Explain CVE-2013-0225
Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1896720'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/user_relationships.git/commitdiff/b9a4739'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1896276'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1896272'}, {'name': '[oss-security] 20130124 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/25/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/user_relationships.git/commitdiff/17e94b9'}]
CVE State: PUBLISHED
Explain CVE-2013-0226
The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1896752'}, {'name': '[oss-security] 20130124 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/25/4'}]
CVE State: PUBLISHED
Explain CVE-2013-0227
Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1896782'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1896756'}, {'name': '[oss-security] 20130124 Re: CVE request for Drupal contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/25/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/search_api_sorts.git/commitdiff/f6cbf47'}]
CVE State: PUBLISHED
Explain CVE-2013-0228
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
Affected Products: n/a
References: [{'name': 'USN-1796-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1796-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9'}, {'name': 'USN-1805-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1805-1'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'USN-1797-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1797-1'}, {'name': 'USN-1808-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1808-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=906309'}, {'name': '[oss-security] 20130213 Xen Security Advisory 42 (CVE-2013-0228) - Linux kernel hits general protection if %ds is corrupt for 32-bit PVOPS.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/13/10'}, {'name': 'USN-1795-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1795-1'}]
CVE State: PUBLISHED
Explain CVE-2013-0229
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play'}]
CVE State: PUBLISHED
Explain CVE-2013-0230
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play'}, {'name': '57608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57608'}, {'name': '36839', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36839/'}]
CVE State: PUBLISHED
Explain CVE-2013-0231
The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '[oss-security] 20130205 Xen Security Advisory 43 (CVE-2013-0231) - Linux pciback DoS via not rate limited log messages.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/05/9'}, {'name': '57740', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57740'}, {'name': 'xen-pcibackenablemsi-dos(81923)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81923'}, {'name': 'openSUSE-SU-2013:0395', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html'}, {'name': '52059', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52059'}, {'name': 'SUSE-SU-2013:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'name': 'DSA-2632', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2632'}, {'name': '89903', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89903'}]
CVE State: PUBLISHED
Explain CVE-2013-0232
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/'}, {'name': '[oss-security] 20130128 Re: CVE Request: zoneminder: arbitrary command execution vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/28/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771'}, {'name': 'DSA-2640', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2640'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910'}, {'name': '24310', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24310'}, {'name': '89529', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/89529'}]
CVE State: PUBLISHED
Explain CVE-2013-0233
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset'}, {'name': "[oss-security] 20130128 Re: CVE request for 'devise' ruby gem", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/29/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html'}, {'name': 'openSUSE-SU-2013:0374', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html'}, {'name': '57577', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57577'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/Snorby/snorby/issues/261'}]
CVE State: PUBLISHED
Explain CVE-2013-0234
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21'}, {'name': '20130129 XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/251'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11'}, {'name': '[oss-security] 20130128 Re: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/29/4'}, {'name': '52007', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52007'}, {'name': '57569', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57569'}]
CVE State: PUBLISHED
Explain CVE-2013-0235
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/23330'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=904120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/news/2013/01/wordpress-3-5-1/'}]
CVE State: PUBLISHED
Explain CVE-2013-0236
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/23322'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=904121'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/23317'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/news/2013/01/wordpress-3-5-1/'}]
CVE State: PUBLISHED
Explain CVE-2013-0237
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=904122'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/news/2013/01/wordpress-3-5-1/'}]
CVE State: PUBLISHED
Explain CVE-2013-0238
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.
Affected Products: n/a
References: [{'name': 'DSA-2618', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2618'}, {'name': '52106', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52106'}, {'name': '[oss-security] 20130129 ircd-hybrid: Denial of service vulnerability in  hostmask.c:try_parse_v4_netmask()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/29/8'}, {'name': 'MDVSA-2013:093', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:093'}, {'name': '57610', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.ircd-hybrid.org:8000/viewcvs.cgi/ircd-hybrid/trunk/src/hostmask.c?r1=1786&r2=1785&pathrev=1786'}, {'name': '51948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51948'}, {'name': 'ircdhybrid-tryparsev4netmask-dos(81695)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81695'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0055'}, {'name': '89623', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89623'}, {'name': '24951', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24951'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699267'}]
CVE State: PUBLISHED
Explain CVE-2013-0240
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e'}, {'name': '51976', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f'}, {'name': '[gnome-announce-list] 20130304 GNOME Online Accounts 3.6.3 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html'}, {'name': 'USN-1779-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1779-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1'}, {'name': '52791', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52791'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=693214'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=894352'}, {'name': 'openSUSE-SU-2013:0301', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html'}]
CVE State: PUBLISHED
Explain CVE-2013-0241
The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=906032'}, {'name': 'MDVSA-2013:138', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:138'}, {'name': '[oss-security] 20130130 CVE request -- qxl: synchronous io guest DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/30/3'}, {'name': 'qxl-virtual-spice-dos(81704)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81704'}, {'name': '52021', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52021'}, {'name': '[oss-security] 20130130 Re: CVE request -- qxl: synchronous io guest DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/30/4'}, {'name': 'USN-1714-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1714-1'}, {'name': 'RHSA-2013:0218', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0218.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0036'}]
CVE State: PUBLISHED
Explain CVE-2013-0242
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2014-0008.html'}, {'name': 'glibc-extendbuffers-dos(81707)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81707'}, {'name': 'RHSA-2013:1605', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1605.html'}, {'name': '55113', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55113'}, {'name': 'USN-1991-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1991-1'}, {'name': '57638', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57638'}, {'name': '89747', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89747'}, {'name': '51951', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51951'}, {'name': '1028063', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028063'}, {'name': '[oss-security] 20130130 Re: CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/30/5'}, {'name': 'GLSA-201503-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201503-04'}, {'name': '[libc-alpha] 20130129 [PATCH] Fix buffer overrun in regexp matcher', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html'}, {'name': 'RHSA-2013:0769', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0769.html'}, {'name': 'MDVSA-2013:163', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:163'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceware.org/bugzilla/show_bug.cgi?id=15078'}]
CVE State: PUBLISHED
Explain CVE-2013-0243
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
Affected Products: haskell-tls-extra
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0243'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0243'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/01/30/6'}]
CVE State: PUBLISHED
Explain CVE-2013-0244
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html'}, {'name': '[oss-security] 20130130 Re: CVE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/211'}, {'name': '89306', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89306'}, {'name': 'DSA-2776', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2776'}, {'name': '20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/SA-CORE-2013-001'}]
CVE State: PUBLISHED
Explain CVE-2013-0245
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html'}, {'name': '[oss-security] 20130130 Re: CVE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/211'}, {'name': '89305', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/89305'}, {'name': 'DSA-2776', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2776'}, {'name': 'drupal-book-title-security-bypass(81380)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81380'}, {'name': '20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/SA-CORE-2013-001'}, {'name': '51717', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51717'}]
CVE State: PUBLISHED
Explain CVE-2013-0246
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html'}, {'name': '[oss-security] 20130130 Re: CVE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/211'}, {'name': '20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2013/Jan/120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/SA-CORE-2013-001'}, {'name': '51717', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51717'}]
CVE State: PUBLISHED
Explain CVE-2013-0247
OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=906171'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/keystone/+bug/1098307'}, {'name': 'FEDORA-2013-2168', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html'}, {'name': 'RHSA-2013:0253', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0253.html'}, {'name': 'USN-1715-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1715-1'}, {'name': '57747', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57747'}]
CVE State: PUBLISHED
Explain CVE-2013-0248
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Affected Products: n/a
References: [{'name': '58326', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58326'}, {'name': 'HPSBMU03409', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=144050155601375&w=2'}, {'name': '20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'name': '90906', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90906'}, {'name': 'GLSA-202107-39', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202107-39'}]
CVE State: PUBLISHED
Explain CVE-2013-0249
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html'}, {'name': '57842', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57842'}, {'name': 'APPLE-SA-2013-10-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'}, {'name': '24487', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/24487'}, {'name': 'USN-1721-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1721-1'}, {'name': 'FEDORA-2013-2098', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099140.html'}, {'name': '1028093', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028093'}, {'name': '89988', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/89988'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.volema.com/curl-rce.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://curl.haxx.se/docs/adv_20130206.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/'}]
CVE State: PUBLISHED
Explain CVE-2013-0250
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
Affected Products: n/a
References: [{'name': '52037', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52037'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595'}, {'name': '[oss-security] 20130201 Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/213'}, {'name': '[oss-security] 20130201 Re: Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/214'}, {'name': '[oss-security] 20130201 CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/212'}]
CVE State: PUBLISHED