Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-1794 State: PUBLISHED Published: 2013-03-12T16:00:00 Last Updated: 2024-08-06T15:13:33.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry. Additional Analyst Notes: - CVE Program Container: References: - http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt - http://secunia.com/advisories/52480 - http://secunia.com/advisories/52342 - http://www.debian.org/security/2013/dsa-2638 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:244 - http:/
http://www.debian.org/security/2013/dsa-2638 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:244 - http://www.securityfocus.com/bid/58299 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82582
CVE ID: CVE-2013-1795 State: PUBLISHED Published: 2013-03-12T16:00:00 Last Updated: 2024-08-06T15:13:32.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/52480 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82585 - http://secunia.com/advisories/52342 - http://www.debian.org/security/2013/dsa-2638 - http://www.securityfocus.com/bid/58300 - http://www.openafs.org/pages/security/OPENA
debian.org/security/2013/dsa-2638 - http://www.securityfocus.com/bid/58300 - http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt - http://www.mandriva.com/security/advisories?name=MDVSA-2014:244
CVE ID: CVE-2013-1796 State: PUBLISHED Published: 2013-03-22T10:00:00 Last Updated: 2024-08-06T15:13:33.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://lists.opensuse.org/opensuse-secur
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html - http://www.ubuntu.com/usn/USN-1812-1 - http://www.ubuntu.com/usn/USN-1805-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://rhn.redhat.com/errata/RHSA-2013-0928.html - http://www.securityfocus.com/bid/58607 - http://www.ubuntu.com/usn/USN-1808-1 - http://www.ubuntu.com/usn/USN-1809-1 - http://rhn.redhat.com/errata/RHSA-2013-0727.html - http://www.openwall.com/lists/oss-security/2013/03/20/9 - http://rhn.redhat.com/errata/RHSA-2013-0744.html - http://rhn.redhat.com/errata/RHSA-2013-0746.html - http://www.ubuntu.
http://rhn.redhat.com/errata/RHSA-2013-0744.html - http://rhn.redhat.com/errata/RHSA-2013-0746.html - http://www.ubuntu.com/usn/USN-1813-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c300aa64ddf57d9c5d9c898a64b36877345dd4a9 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - https://github.com/torvalds/linux/commit/c300aa64ddf57d9c5d9c898a64b36877345dd4a9 - https://bugzilla.redhat.com/show_bug.cgi?id=917012 - http://rhn.redhat.com/errata/RHSA-2013-1026.html
CVE ID: CVE-2013-1797 State: PUBLISHED Published: 2013-03-22T10:00:00 Last Updated: 2024-08-06T15:13:33.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://
VE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html - http://www.ubuntu.com/usn/USN-1812-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b79459b482e85cb7426aa7da683a9f2c97aeae1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://rhn.redhat.com/errata/RHSA-2013-0928.html - http://www.ubuntu.com/usn/USN-1809-1 - http://rhn.redhat.com/errata/RHSA-2013-0727.html - http://www.openwall.com/lists/oss-security/2013/03/20/9 - https://bugzilla.redhat.com/show_bug.cgi?id=917013 - https://github.com/torvalds/li
om/lists/oss-security/2013/03/20/9 - https://bugzilla.redhat.com/show_bug.cgi?id=917013 - https://github.com/torvalds/linux/commit/0b79459b482e85cb7426aa7da683a9f2c97aeae1 - http://rhn.redhat.com/errata/RHSA-2013-0744.html - http://rhn.redhat.com/errata/RHSA-2013-0746.html - http://www.ubuntu.com/usn/USN-1813-1 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - http://rhn.redhat.com/errata/RHSA-2013-1026.html
CVE ID: CVE-2013-1798 State: PUBLISHED Published: 2013-03-22T10:00:00 Last Updated: 2024-08-06T15:13:33.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://lists.opensuse.org/opensuse-secur
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2c118bfab8bc6b8bb213abfc35201e441693d55 - https://github.com/torvalds/linux/commit/a2c118bfab8bc6b8bb213abfc35201e441693d55 - http://www.ubuntu.com/usn/USN-1812-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://rhn.redhat.com/errata/RHSA-2013-0928.html - http://www.ubuntu.com/usn/USN-1809-1 - http://rhn.redhat.com/errata/RHSA-2013-0727.html - http://www.openwall.com/lists/oss-security/2013/03/20/9 - http://rhn.redhat.com/errata/RHS
/errata/RHSA-2013-0727.html - http://www.openwall.com/lists/oss-security/2013/03/20/9 - http://rhn.redhat.com/errata/RHSA-2013-0744.html - http://rhn.redhat.com/errata/RHSA-2013-0746.html - http://www.ubuntu.com/usn/USN-1813-1 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - https://bugzilla.redhat.com/show_bug.cgi?id=917017 - http://rhn.redhat.com/errata/RHSA-2013-1026.html - http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
CVE ID: CVE-2013-1799 State: PUBLISHED Published: 2013-03-28T17:00:00Z Last Updated: 2024-08-06T15:13:33.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240. Additional Analyst Notes: - CVE Program Container: References: - https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html - https://git.gno
Container: References: - https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html - https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8 - http://secunia.com/advisories/51976 - https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html - https://bugzilla.gnome.org/show_bug.cgi?id=695106 - http://ubuntu.com/usn/usn-1779-1 - http://secunia.com/advisories/52791 - https://bugzilla.gnome.org/show_bug.cgi?id=693214 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html
CVE ID: CVE-2013-1800 State: PUBLISHED Published: 2013-04-09T20:00:00Z Last Updated: 2024-08-06T15:13:33.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=917236 - http://secunia.com/advisorie
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=917236 - http://secunia.com/advisories/52897 - https://bugzilla.novell.com/show_bug.cgi?id=804721 - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00003.html - https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately - https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6
CVE ID: CVE-2013-1801 State: PUBLISHED Published: 2013-04-09T20:00:00Z Last Updated: 2024-08-06T15:13:32.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031 - https://support.cloud.e
nces: - https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031 - https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately - https://bugzilla.redhat.com/show_bug.cgi?id=917229 - http://www.securityfocus.com/bid/58260
CVE ID: CVE-2013-1802 State: PUBLISHED Published: 2013-04-09T20:00:00Z Last Updated: 2024-08-06T15:13:33.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d2
: - CVE Program Container: References: - https://github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d22879b5...4540e7102b803624cc2eade4bb8aaaa934fc31c5 - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00002.html - https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately - https://bugzilla.redhat.com/show_bug.cgi?id=917233
CVE ID: CVE-2013-1803 State: PUBLISHED Published: 2014-05-05T17:00:00 Last Updated: 2024-08-06T15:13:33.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox pa
o forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Auth
r the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375. Additional Analyst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-97.html - http://osvdb.org/show/osvdb/90714 - http://www.openwall.com/lists/oss-security/2013/03/03/2 - http://osvdb.org/90710 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://osvdb.org/90712 - http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html - http://www.php-fusion.co.uk/news.php?readmore=569 - http://osvdb.org/90709 - http://osvdb.org/90713 - http://osvdb.org/90711
//www.php-fusion.co.uk/news.php?readmore=569 - http://osvdb.org/90709 - http://osvdb.org/90713 - http://osvdb.org/90711 - http://osvdb.org/90693 - http://osvdb.org/90695 - http://seclists.org/fulldisclosure/2013/Feb/154 - http://secunia.com/advisories/52403
CVE ID: CVE-2013-1804 State: PUBLISHED Published: 2014-04-29T20:00:00 Last Updated: 2024-08-06T15:13:33.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_ed
houtbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-97.html - http://www.openwall.com/lists/oss-security/2013/03/03/2 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://osv
/www.openwall.com/lists/oss-security/2013/03/03/2 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://osvdb.org/90707 - http://osvdb.org/90708 - http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html - http://www.php-fusion.co.uk/news.php?readmore=569 - http://seclists.org/fulldisclosure/2013/Feb/154 - http://secunia.com/advisories/52403
CVE ID: CVE-2013-1805 State: REJECTED Published: 2014-04-30T22:00:00 Last Updated: 2014-04-30T21:57:00 Description: No description available.
CVE ID: CVE-2013-1806 State: PUBLISHED Published: 2014-04-30T22:00:00 Last Updated: 2024-08-06T15:13:33.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-97.html - http://www.openwall.com/lists/
yst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-97.html - http://www.openwall.com/lists/oss-security/2013/03/03/2 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://www.osvdb.org/90692 - http://www.osvdb.org/90694 - http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html - http://www.php-fusion.co.uk/news.php?readmore=569 - http://www.osvdb.org/90696 - http://seclists.org/fulldisclosure/2013/Feb/154
CVE ID: CVE-2013-1807 State: PUBLISHED Published: 2014-04-30T22:00:00 Last Updated: 2024-08-06T15:13:32.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/. Additional Analyst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-97.html - http://www.openwall.com/lists/oss-security/2013/03/03/2 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://www.osvdb.org/90691 - http://packet
rity/2013/03/03/2 - http://www.openwall.com/lists/oss-security/2013/03/03/1 - http://www.osvdb.org/90691 - http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html - http://www.php-fusion.co.uk/news.php?readmore=569 - http://seclists.org/fulldisclosure/2013/Feb/154
CVE ID: CVE-2013-1808 State: PUBLISHED Published: 2013-03-28T17:00:00 Last Updated: 2024-08-06T15:13:32.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7
onal Analyst Notes: - CVE Program Container: References: - https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696 - http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb - http://www.openwall.com/lists/oss-security/2013/03/26/8 - http://seclists.org/fulldisclosure/2013/Feb/103 - http://seclists.org/fulldisclosure/2013/Feb/109 - http://securityvulns.ru/docs29105.html - http://www.openwall.com/lists/oss-security/2013/03/03/3 - http://seclists.org/fulldisclosure/2013/Mar/5 - http://seclists.org/fulldisclosure/2013/Apr/87 - http://securityvulns.ru/docs29103.html - http://securityvulns.ru/docs29104.html - https://github.com/jonrohan/Z
Apr/87 - http://securityvulns.ru/docs29103.html - http://securityvulns.ru/docs29104.html - https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108 - http://www.openwall.com/lists/oss-security/2013/03/10/2 - http://seclists.org/fulldisclosure/2013/Apr/88 - http://www.openwall.com/lists/oss-security/2013/03/25/1 - http://www.securityfocus.com/bid/58257
CVE ID: CVE-2013-1809 State: PUBLISHED Published: 2019-11-07T22:18:17 Last Updated: 2024-08-06T15:13:32.988Z Vendors: gambas3 Products: gambas3 Problem Types: Symbolic Link Following Description: Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-1809 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1809 - https://access.redhat.com/security/cve/cve-2013-1809 - http://www.openwall.com/lists/oss-security/2013/03/03/4 - https://code.google.com/archive/p/gamba
ty/cve/cve-2013-1809 - http://www.openwall.com/lists/oss-security/2013/03/03/4 - https://code.google.com/archive/p/gambas/issues/365 - https://sourceforge.net/p/gambas/code/5438/
CVE ID: CVE-2013-1810 State: PUBLISHED Published: 2014-05-15T14:00:00 Last Updated: 2024-08-06T15:13:33.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q1/127 - http://seclists.org/oss-sec/2013/q1/556 - http://secunia.com/advisories/51853 - http://w
lists.org/oss-sec/2013/q1/127 - http://seclists.org/oss-sec/2013/q1/556 - http://secunia.com/advisories/51853 - http://www.mantisbt.org/bugs/view.php?id=15384
CVE ID: CVE-2013-1811 State: PUBLISHED Published: 2019-11-07T22:28:06 Last Updated: 2024-08-06T15:13:33.247Z Vendors: mantis Products: mantis Problem Types: Other Description: An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-1811 - http://www.debian.org/security/2015/dsa-3120 - http://www.openwall.com/lists/oss-security/2013/03/03/6 - http://www.openwall.com/lists/oss-security/2013/03/04/9 - https://mantisbt.org/bugs/view.php?id=15258
CVE ID: CVE-2013-1812 State: PUBLISHED Published: 2013-12-12T18:00:00 Last Updated: 2024-08-06T15:13:33.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=918134 - https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html - https://github.com/openid/ruby-openid/pull/43 - https://github.com/o
ermail/package-announce/2013-November/120361.html - https://github.com/openid/ruby-openid/pull/43 - https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html - http://www.openwall.com/lists/oss-security/2013/03/03/8