Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-2186 State: PUBLISHED Published: 2013-10-28T21:00:00 Last Updated: 2024-08-06T15:27:40.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1430.html - http://rhn.redhat.com/errata/RHSA-2013-1429.html - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - https://exchan
/errata/RHSA-2013-1429.html - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/88133 - http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - http://secunia.com/advisories/55716 - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html - http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html - http://rhn.redhat.com/errata/RHSA-2013-1428.html - http://www.debian.org/security/2013/dsa-2827 - https://access.redhat.com/errata/R
edhat.com/errata/RHSA-2013-1428.html - http://www.debian.org/security/2013/dsa-2827 - https://access.redhat.com/errata/RHSA-2016:0070 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 - http://rhn.redhat.com/errata/RHSA-2013-1442.html - http://rhn.redhat.com/errata/RHSA-2013-1448.html - https://www.tenable.com/security/research/tra-2016-23 - http://www.securityfocus.com/bid/63174 - http://ubuntu.com/usn/usn-2029-1
CVE ID: CVE-2013-2187 State: PUBLISHED Published: 2014-04-22T14:00:00 Last Updated: 2024-08-06T15:27:41.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66991 - http://archiva.apache.org/security.html - http://www.securityfocus.com/archive/1/531884/100/0/threaded - http://www.securitytracker.com/id/1030130
CVE ID: CVE-2013-2188 State: PUBLISHED Published: 2013-07-16T10:00:00Z Last Updated: 2024-08-06T15:27:40.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle failure to obtain write permissions, which allows local users to cause a denial of service (system crash) by leveraging access to a filesystem that is mounted read-only. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=975406
CVE ID: CVE-2013-2189 State: PUBLISHED Published: 2013-07-31T10:00:00Z Last Updated: 2024-09-16T16:43:50.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2013/Jul/173 - http://www.openoffice.org/security/cves/CVE-2013-2189.html - http://osvdb.org/95704
CVE ID: CVE-2013-2190 State: PUBLISHED Published: 2013-10-17T23:00:00Z Last Updated: 2024-08-06T15:27:41.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The translate_hierarchy_event function in x11/clutter-device-manager-xi2.c in Clutter, when resuming the system, does not properly handle XIQueryDevice errors when a device has "disappeared," which causes the gnome-shell to crash and allows physically proximate attackers to access the previous gnome-shell session via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnome.org/browse/clutter/commit/?h=clutter-1.14&id=e310c68d7b38d521e341f4e8a36f54303079d74e - http://www.openwall.
//git.gnome.org/browse/clutter/commit/?h=clutter-1.14&id=e310c68d7b38d521e341f4e8a36f54303079d74e - http://www.openwall.com/lists/oss-security/2013/06/19/1 - https://bugzilla.redhat.com/show_bug.cgi?id=980111 - https://bugzilla.gnome.org/show_bug.cgi?id=701974 - http://lists.opensuse.org/opensuse-updates/2013-10/msg00014.html - https://git.gnome.org/browse/clutter/commit/?h=clutter-1.16&id=d343cc6289583a7b0d929b82b740499ed588b1ab
CVE ID: CVE-2013-2191 State: PUBLISHED Published: 2014-02-08T00:00:00 Last Updated: 2024-08-06T15:27:41.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/06/19/6 - http://lists.opensuse.org/opensuse-updates/2013-07/msg00026.html - https://git.fedorahosted.org/cgit/python-bugzilla.git/commit/?id=a782282ee479ba4cc1b8b1d89700ac630ba83eef - http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html - https:
?id=a782282ee479ba4cc1b8b1d89700ac630ba83eef - http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html - https://bugzilla.redhat.com/show_bug.cgi?id=951594 - https://lists.fedorahosted.org/pipermail/python-bugzilla/2013-June/000104.html
CVE ID: CVE-2013-2192 State: PUBLISHED Published: 2014-01-24T18:00:00 Last Updated: 2024-08-06T15:27:41.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0037.html - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html - htt
rata/RHSA-2014-0037.html - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html - http://rhn.redhat.com/errata/RHSA-2014-0400.html - http://secunia.com/advisories/57915 - http://seclists.org/fulldisclosure/2013/Aug/251
CVE ID: CVE-2013-2193 State: PUBLISHED Published: 2014-05-29T14:00:00 Last Updated: 2024-08-06T15:27:41.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html - http://osvdb.org/96615 - http://seclists.org/fulldisclosure/2013/Aug/250
CVE ID: CVE-2013-2194 State: PUBLISHED Published: 2013-08-23T16:00:00 Last Updated: 2024-08-06T15:27:40.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html - http://secunia.com/advisories/55082 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/20/4 - http://www.openwall.com/lists/oss-security/2013/06/2
-24.xml - http://www.openwall.com/lists/oss-security/2013/06/20/4 - http://www.openwall.com/lists/oss-security/2013/06/20/2 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.debian.org/security/2014/dsa-3006 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html - http://support.citrix.com/article/CTX138058
CVE ID: CVE-2013-2195 State: PUBLISHED Published: 2013-08-23T16:00:00 Last Updated: 2024-08-06T15:27:41.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html - http://secunia.com/advisories/55082 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/20/4 - http://www.op
://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/20/4 - http://www.openwall.com/lists/oss-security/2013/06/20/2 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.debian.org/security/2014/dsa-3006 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html - http://support.citrix.com/article/CTX138058
CVE ID: CVE-2013-2196 State: PUBLISHED Published: 2013-08-23T16:00:00 Last Updated: 2024-08-06T15:27:41.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html - http://secunia.com/advisories/55082 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lis
- http://secunia.com/advisories/55082 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/20/4 - http://www.openwall.com/lists/oss-security/2013/06/20/2 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.debian.org/security/2014/dsa-3006 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html - http://support.citrix.com/article/CTX138058
CVE ID: CVE-2013-2197 State: PUBLISHED Published: 2013-08-28T15:00:00Z Last Updated: 2024-09-17T03:12:25.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal, when using the login delay option, allows remote attackers to cause a denial of service (CPU consumption) via a large number of failed login attempts. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/2023585 - http://www.openwall.com/lists/oss-security/2013/06/20/3 - https://drupal.org/node/2023507 - https://drupal.org/node/2023503
CVE ID: CVE-2013-2198 State: PUBLISHED Published: 2020-01-30T20:35:21 Last Updated: 2024-08-06T15:27:41.103Z Vendors: Login Security Products: Login Security Problem Types: Weak Authentication Description: The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/2023507 - https://drupal.org/node/2023503 - http://www.openwall.com/lists/oss-security/2013/06/20/3 - https://drupal.org/node/2023585
CVE ID: CVE-2013-2199 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2200 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2201 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?i
ews/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2202 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2203 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2204 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.d
Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://codex.wordpress.org/Version_3.5.2 - https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2dcf2f3f37dbfab0
CVE ID: CVE-2013-2205 State: PUBLISHED Published: 2013-07-08T20:00:00 Last Updated: 2024-08-06T15:27:41.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/news/2013/06/wordpress-3-5-2/ - http://www.debian.org/security/2013/dsa-2718 - https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://make.wordpress.org/core/2013/06/21/secure-swfupload/ - ht
- https://bugzilla.redhat.com/show_bug.cgi?id=976784 - http://make.wordpress.org/core/2013/06/21/secure-swfupload/ - http://www.securityfocus.com/bid/60759 - http://codex.wordpress.org/Version_3.5.2
CVE ID: CVE-2013-2206 State: PUBLISHED Published: 2013-07-04T21:00:00 Last Updated: 2024-08-06T15:27:41.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1166.html - http://lists.opensuse.org/
es: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1166.html - http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00023.html - https://github.com/torvalds/linux/commit/f2815633504b442ca0b0605c16bf3d88a3a0fcea - http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00024.html - http://rhn.redhat.com/errata/RHSA-2013-1173.html - http://www.debian.org/security/2013/dsa-2766 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html - http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00021.html - http://www.kernel.org/pub/linux/kernel/v3.x/Chang
/lists.opensuse.org/opensuse-security-announce/2013-11/msg00021.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.5 - https://bugzilla.redhat.com/show_bug.cgi?id=976562 - http://www.ubuntu.com/usn/USN-1939-1 - http://www.openwall.com/lists/oss-security/2013/06/21/1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f2815633504b442ca0b0605c16bf3d88a3a0fcea
CVE ID: CVE-2013-2207 State: PUBLISHED Published: 2013-10-09T22:00:00 Last Updated: 2024-08-06T15:27:41.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=15755 - http://secunia.com/advisories/55113 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html - https://sourceware.org/ml/libc-alpha/2013
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html - https://sourceware.org/ml/libc-alpha/2013-08/msg00160.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html - http://www.ubuntu.com/usn/USN-2985-2 - https://bugzilla.redhat.com/show_bug.cgi?id=976408 - https://security.gentoo.org/glsa/201503-04 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:283 - http://www.ubuntu.com/usn/USN-2985-1
CVE ID: CVE-2013-2208 State: PUBLISHED Published: 2013-10-28T22:00:00Z Last Updated: 2024-08-06T15:27:41.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/06/21/4 - http://security.gentoo.org/glsa/glsa-201309-19.xml - https://github.com/akrennmair/tpp/pull/2 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706644
CVE ID: CVE-2013-2209 State: PUBLISHED Published: 2013-07-31T10:00:00 Last Updated: 2024-08-06T15:27:41.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name. Additional Analyst Notes: - CVE Program Container: References: - http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard - https://bugzilla.redhat.com/show_bug.cgi?id=977423 - http://www.reviewboard.org/news/2013/06/22/review-b
r-reviewboard - https://bugzilla.redhat.com/show_bug.cgi?id=977423 - http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/ - http://www.openwall.com/lists/oss-security/2013/06/24/2 - https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf - http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/ - http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/
CVE ID: CVE-2013-2210 State: PUBLISHED Published: 2013-08-20T22:00:00 Last Updated: 2024-08-06T15:27:41.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0216.html - http://santuario.apache.org/secadv.data/CVE-2
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0216.html - http://santuario.apache.org/secadv.data/CVE-2013-2210.txt - https://www.tenable.com/security/tns-2018-15 - http://www.debian.org/security/2013/dsa-2717 - https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E - https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E
CVE ID: CVE-2013-2211 State: PUBLISHED Published: 2013-08-28T17:00:00 Last Updated: 2024-08-06T15:27:41.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55082 - http://www.openwall.com/lists/oss-security/2013/06/26/4 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/25/
13/06/26/4 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://www.openwall.com/lists/oss-security/2013/06/25/1 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.debian.org/security/2014/dsa-3006