Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-0228 State: PUBLISHED Published: 2013-03-01T11:00:00 Last Updated: 2024-08-06T14:18:09.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1796-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9 - http://www.ubuntu.com/usn/USN-1805-1 - http://www.mandriva.com/security/advisories?name=MDVS
rnel/v3.x/ChangeLog-3.7.9 - http://www.ubuntu.com/usn/USN-1805-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://www.ubuntu.com/usn/USN-1797-1 - http://www.ubuntu.com/usn/USN-1808-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc - https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc - https://bugzilla.redhat.com/show_bug.cgi?id=906309 - http://www.openwall.com/lists/oss-security/2013/02/13/10 - http://www.ubuntu.com/usn/USN-1795-1
CVE ID: CVE-2013-0229 State: PUBLISHED Published: 2013-01-31T21:00:00 Last Updated: 2024-08-06T14:18:09.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf - https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb - https://community.rapid7.com/community/infosec/blog/2013/01/29/secu
/servlet/servlet.FileDownload?file=00P1400000cCaFb - https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
CVE ID: CVE-2013-0230 State: PUBLISHED Published: 2013-01-31T21:00:00 Last Updated: 2024-08-06T14:18:09.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf - https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb - https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-
et.FileDownload?file=00P1400000cCaFb - https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play - http://www.securityfocus.com/bid/57608 - https://www.exploit-db.com/exploits/36839/
CVE ID: CVE-2013-0231 State: PUBLISHED Published: 2013-02-13T01:00:00 Last Updated: 2024-08-06T14:18:09.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/02/05/9 - http://www.securityfocus.com/bid/57740 - https://exchange.xforce.ibmcl
ww.openwall.com/lists/oss-security/2013/02/05/9 - http://www.securityfocus.com/bid/57740 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81923 - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html - http://secunia.com/advisories/52059 - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - http://www.debian.org/security/2013/dsa-2632 - http://osvdb.org/89903
CVE ID: CVE-2013-0232 State: PUBLISHED Published: 2013-03-20T15:00:00Z Last Updated: 2024-08-06T14:18:09.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function. Additional Analyst Notes: - CVE Program Container: References: - http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/ - http://www.openwall.com/lists/oss-security/2013/01/28/2 - http:/
deo-Server-arbitrary-command-execution-vulnerability/ - http://www.openwall.com/lists/oss-security/2013/01/28/2 - http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771 - http://www.debian.org/security/2013/dsa-2640 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 - http://www.exploit-db.com/exploits/24310 - http://www.osvdb.org/89529
CVE ID: CVE-2013-0233 State: PUBLISHED Published: 2013-04-25T23:00:00Z Last Updated: 2024-09-17T02:41:33.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts. Additional Analyst Notes: - CVE Program Container: References: - http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_p
lyst Notes: - CVE Program Container: References: - http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset - http://www.openwall.com/lists/oss-security/2013/01/29/3 - http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html - http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html - http://www.securityfocus.com/bid/57577 - http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/ - https://github.com/Snorby/snorby/issues/261
CVE ID: CVE-2013-0234 State: PUBLISHED Published: 2014-02-02T20:00:00 Last Updated: 2024-08-06T14:18:09.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save. Additional Analyst Notes: - CVE Program Container: References: - http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717 - http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html - https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5
Elgg-Twitter-Widget-Cross-Site-Scripting.html - https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21 - http://seclists.org/fulldisclosure/2013/Jan/251 - https://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11 - http://www.openwall.com/lists/oss-security/2013/01/29/4 - http://secunia.com/advisories/52007 - http://www.securityfocus.com/bid/57569
CVE ID: CVE-2013-0235 State: PUBLISHED Published: 2013-07-08T20:00:00Z Last Updated: 2024-09-16T19:46:35.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue. Additional Analyst Notes: - CVE Program Container: References: - http://codex.wordpress.org/Version_3.5.1 - http://core.trac.wordpress.org/changeset/23330 - http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/ - https://bugzilla.redhat.com/show_bug.cgi?i
//www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/ - https://bugzilla.redhat.com/show_bug.cgi?id=904120 - http://wordpress.org/news/2013/01/wordpress-3-5-1/
CVE ID: CVE-2013-0236 State: PUBLISHED Published: 2013-07-08T20:00:00Z Last Updated: 2024-09-16T22:55:24.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post. Additional Analyst Notes: - CVE Program Container: References: - http://core.trac.wordpress.org/changeset/23322 - http://codex.wordpress.org/Version_3.5.1 - https://bugzilla.redhat.com/show_bug.cgi?id=904121 - http://core.trac.wordpress.org/changeset/23317 - http://wordpress.org/news/2013/01/wordpress-3-5-1/
CVE ID: CVE-2013-0237 State: PUBLISHED Published: 2013-07-08T20:00:00Z Last Updated: 2024-09-16T22:21:09.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=904122 - http://codex.wordpress.org/Version_3.5.1 - https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5 - http://wordpress.org/news/2013/01/wordpress-3-5-1/
CVE ID: CVE-2013-0238 State: PUBLISHED Published: 2013-02-13T01:00:00 Last Updated: 2024-08-06T14:18:09.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2013/dsa-2618 - http://secunia.com/advisories/52106 - http://www.openwall.com/lists/oss-security/2013/01/29/8 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:093 - http://www.securityfocus.c
oss-security/2013/01/29/8 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:093 - http://www.securityfocus.com/bid/57610 - http://svn.ircd-hybrid.org:8000/viewcvs.cgi/ircd-hybrid/trunk/src/hostmask.c?r1=1786&r2=1785&pathrev=1786 - http://secunia.com/advisories/51948 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81695 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0055 - http://osvdb.org/89623 - http://www.exploit-db.com/exploits/24951 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699267
CVE ID: CVE-2013-0239 State: PUBLISHED Published: 2013-03-12T22:00:00 Last Updated: 2024-08-06T14:18:09.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/90078 - http://secunia.com/advisories/51988 - http://seclists.org/fulldisclosure/2013/Feb/39 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81981 - h
/51988 - http://seclists.org/fulldisclosure/2013/Feb/39 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81981 - http://cxf.apache.org/cve-2013-0239.html - http://www.securityfocus.com/bid/57876 - http://rhn.redhat.com/errata/RHSA-2013-0749.html - http://svn.apache.org/viewvc?view=revision&revision=1438424 - http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.h
44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2013-0240 State: PUBLISHED Published: 2013-03-28T17:00:00Z Last Updated: 2024-08-06T14:18:09.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e - http://secunia.com/advisories/51976 - https://git.gno
ine-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e - http://secunia.com/advisories/51976 - https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f - https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html - http://ubuntu.com/usn/usn-1779-1 - https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1 - http://secunia.com/advisories/52791 - https://bugzilla.gnome.org/show_bug.cgi?id=693214 - https://bugzilla.redhat.com/show_bug.cgi?id=894352 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html
CVE ID: CVE-2013-0241 State: PUBLISHED Published: 2013-02-13T01:00:00 Last Updated: 2024-08-06T14:18:09.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=906032 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:138 - http://www.openwall.com/lists/oss-security/2013/01/30/3 - https://excha
va.com/security/advisories?name=MDVSA-2013:138 - http://www.openwall.com/lists/oss-security/2013/01/30/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81704 - http://secunia.com/advisories/52021 - http://www.openwall.com/lists/oss-security/2013/01/30/4 - http://www.ubuntu.com/usn/USN-1714-1 - http://rhn.redhat.com/errata/RHSA-2013-0218.html - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0036
CVE ID: CVE-2013-0242 State: PUBLISHED Published: 2013-02-08T20:00:00 Last Updated: 2024-08-06T14:18:09.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0008.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/81707 - http://rhn.redhat.com/errata/RHSA-2013-1605.html - http://secunia.com/advisori
orce.ibmcloud.com/vulnerabilities/81707 - http://rhn.redhat.com/errata/RHSA-2013-1605.html - http://secunia.com/advisories/55113 - http://www.ubuntu.com/usn/USN-1991-1 - http://www.securityfocus.com/bid/57638 - http://osvdb.org/89747 - http://secunia.com/advisories/51951 - http://www.securitytracker.com/id/1028063 - http://www.openwall.com/lists/oss-security/2013/01/30/5 - https://security.gentoo.org/glsa/201503-04 - http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html - http://rhn.redhat.com/errata/RHSA-2013-0769.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:163 - http://sourceware.org/bugzilla/show_bug.cgi?id=15078
CVE ID: CVE-2013-0243 State: PUBLISHED Published: 2019-12-05T15:16:46 Last Updated: 2024-08-06T14:18:09.737Z Vendors: haskell-tls-extra Products: haskell-tls-extra Problem Types: constraints vulnerability Description: haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-0243 - https://access.redhat.com/security/cve/cve-2013-0243 - http://www.openwall.com/lists/oss-security/2013/01/30/6
CVE ID: CVE-2013-0244 State: PUBLISHED Published: 2014-01-19T17:00:00 Last Updated: 2024-08-06T14:18:09.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html - http://seclists.org/oss-sec/2013/q1/
rity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html - http://seclists.org/oss-sec/2013/q1/211 - http://osvdb.org/89306 - http://www.debian.org/security/2013/dsa-2776 - http://seclists.org/fulldisclosure/2013/Jan/120 - https://drupal.org/SA-CORE-2013-001
CVE ID: CVE-2013-0245 State: PUBLISHED Published: 2013-07-16T18:00:00 Last Updated: 2024-08-06T14:18:09.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html - http://seclis
http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html - http://seclists.org/oss-sec/2013/q1/211 - http://osvdb.org/89305 - http://www.debian.org/security/2013/dsa-2776 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81380 - http://seclists.org/fulldisclosure/2013/Jan/120 - https://drupal.org/SA-CORE-2013-001 - http://secunia.com/advisories/51717
CVE ID: CVE-2013-0246 State: PUBLISHED Published: 2013-07-16T18:00:00Z Last Updated: 2024-09-16T20:57:50.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html - http://seclists.org/oss-sec/2013/q1/211 - http://seclists.org/fulldisclosure/2013/Jan/120 - https://drupal.org/S
.html - http://seclists.org/oss-sec/2013/q1/211 - http://seclists.org/fulldisclosure/2013/Jan/120 - https://drupal.org/SA-CORE-2013-001 - http://secunia.com/advisories/51717
CVE ID: CVE-2013-0247 State: PUBLISHED Published: 2013-02-24T19:00:00Z Last Updated: 2024-08-06T14:18:09.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=906171 - https://bugs.launchpad.net/keystone/+bug/1098307 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html - http://rhn.r
ystone/+bug/1098307 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html - http://rhn.redhat.com/errata/RHSA-2013-0253.html - http://www.ubuntu.com/usn/USN-1715-1 - http://www.securityfocus.com/bid/57747
CVE ID: CVE-2013-0248 State: PUBLISHED Published: 2013-03-15T01:00:00 Last Updated: 2024-08-06T14:18:09.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/58326 - http://marc.info/?l=bugtraq&m=144050155601375&w=2 - http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-32366
.neohapsis.com/archives/bugtraq/2013-03/0035.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.osvdb.org/90906 - https://security.gentoo.org/glsa/202107-39
CVE ID: CVE-2013-0249 State: PUBLISHED Published: 2013-03-08T22:00:00 Last Updated: 2024-08-06T14:18:09.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - http://packetstor
m Container: References: - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - http://packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html - http://www.securityfocus.com/bid/57842 - http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html - http://www.exploit-db.com/exploits/24487 - http://www.ubuntu.com/usn/USN-1721-1 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099140.html - http://www.securitytracker.com/id/1028093 - http://www.osvdb.org/89988 - http://packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html - http://blog.volema.com/curl-rce.html - http://curl.haxx.se/docs/adv_20130206
om/files/120147/cURL-Buffer-Overflow.html - http://blog.volema.com/curl-rce.html - http://curl.haxx.se/docs/adv_20130206.html - http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/