Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-2111 State: PUBLISHED Published: 2014-05-27T15:00:00 Last Updated: 2024-08-06T15:27:40.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/53492 - http://www.securitytracker.com/id/1028585 - http://www.openwall.com/lists/oss-security/2013/05/24/1 - http://www.dovecot.org/list/dovecot-news/2013-May/000255.html
CVE ID: CVE-2013-2112 State: PUBLISHED Published: 2013-07-31T10:00:00 Last Updated: 2024-08-06T15:27:40.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E - http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E - http://
box/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E - http://rhn.redhat.com/errata/RHSA-2014-0255.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19057 - http://www.ubuntu.com/usn/USN-1893-1 - https://subversion.apache.org/security/CVE-2013-2112-advisory.txt - http://www.debian.org/security/2013/dsa-2703 - http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html
CVE ID: CVE-2013-2113 State: PUBLISHED Published: 2013-07-31T10:00:00Z Last Updated: 2024-08-06T15:27:40.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0995.html - https://bugzilla.redhat.com/show_bug.cgi?id=968166 - http://projects.theforeman.org/issues/2630 - https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugi
=968166 - http://projects.theforeman.org/issues/2630 - https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU
CVE ID: CVE-2013-2114 State: PUBLISHED Published: 2013-11-15T18:16:00Z Last Updated: 2024-09-16T23:41:52.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55433 - http://www.openwall.com/lists/oss-security/2013/05/24/3 - http://security.gentoo.org/glsa/glsa-201310-21.xml - https://bugzilla.wikimedia.org/show_bug.cgi?id=48306 - http://lists.wikimedia.org/pipermail/medi
sa/glsa-201310-21.xml - https://bugzilla.wikimedia.org/show_bug.cgi?id=48306 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-May/000131.html
CVE ID: CVE-2013-2115 State: PUBLISHED Published: 2013-07-10T19:00:00Z Last Updated: 2024-09-16T19:14:04.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/60167 - https://bugzilla.redhat.com/show_bug.cgi?id=967656 - http://struts.apache.org/development/2.x/docs/s2-014.html - https://cwiki.apache.org/confluence/displa
g.cgi?id=967656 - http://struts.apache.org/development/2.x/docs/s2-014.html - https://cwiki.apache.org/confluence/display/WW/S2-014
CVE ID: CVE-2013-2116 State: PUBLISHED Published: 2013-07-03T18:00:00 Last Updated: 2024-08-06T15:27:40.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57260 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00019.html - http://secunia.com/advisories/57274 - http://lists.opensuse.org/opensuse-security-announce/20
ce/2013-06/msg00019.html - http://secunia.com/advisories/57274 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:171 - http://rhn.redhat.com/errata/RHSA-2013-0883.html - http://www.debian.org/security/2013/dsa-2697 - http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6754 - http://www.gnutls.org/security.html#GNUTLS-SA-2013-2 - http://secunia.com/advisories/53911 - https://gitorious.org/gnutls/gnutls/commit/5164d5a1d57cd0372a5dd074382ca960ca18b27d - http://www.ubuntu.com/usn/USN-1843-1 - http://www.securitytracker.co
s/commit/5164d5a1d57cd0372a5dd074382ca960ca18b27d - http://www.ubuntu.com/usn/USN-1843-1 - http://www.securitytracker.com/id/1028603 - http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6753
CVE ID: CVE-2013-2117 State: PUBLISHED Published: 2013-08-09T18:00:00 Last Updated: 2024-08-06T15:27:40.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/54186 - http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6 - http://lists.opensuse.org/opensuse-updates/2013-08/msg00012.html - http://www.openwall.com/lists/oss
3213c062663cdadd6 - http://lists.opensuse.org/opensuse-updates/2013-08/msg00012.html - http://www.openwall.com/lists/oss-security/2013/05/27/3 - http://lists.zx2c4.com/pipermail/cgit/2013-May/001394.html - http://lists.opensuse.org/opensuse-updates/2013-07/msg00061.html
CVE ID: CVE-2013-2118 State: PUBLISHED Published: 2013-07-09T17:00:00Z Last Updated: 2024-09-16T23:05:53.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php. Additional Analyst Notes: - CVE Program Container: References: - http://contrib.spip.net/SPIP-3-0-9-2-1-22-2-0-23-corrections-de-bug-et-faille?lang=fr - http://core.spip.org/projects/spip/repository/revisions/20541 - http://www.openwall.com/lists/oss-security/2013/05/27/2 - http://www.debian.org/security/2013/dsa-2694
CVE ID: CVE-2013-2119 State: PUBLISHED Published: 2014-01-02T21:00:00 Last Updated: 2024-08-06T15:27:40.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=892813 - http://rhn.redhat.com/errata/RHSA-2013-1136.html - http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ - http://bl
redhat.com/errata/RHSA-2013-1136.html - http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ - http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/
CVE ID: CVE-2013-2120 State: PUBLISHED Published: 2020-02-11T19:03:18 Last Updated: 2024-08-06T15:27:40.910Z Vendors: n/a Products: KDE Paste Applet Problem Types: Insufficient Random Number Generation Description: The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=969421 - https://projects.kde.org/projects/kde/kdeplasma-addons/repository/revisions/36a1fe49cb70f717c4a6e9eeee2c9186503a8dce - http://
//projects.kde.org/projects/kde/kdeplasma-addons/repository/revisions/36a1fe49cb70f717c4a6e9eeee2c9186503a8dce - http://archives.neohapsis.com/archives/bugtraq/2013-05/0114.html - http://openwall.com/lists/oss-security/2013/05/28/5 - http://openwall.com/lists/oss-security/2013/05/29/6
CVE ID: CVE-2013-2121 State: PUBLISHED Published: 2013-07-31T10:00:00Z Last Updated: 2024-08-06T15:27:40.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute. Additional Analyst Notes: - CVE Program Container: References: - http://projects.theforeman.org/issues/2631 - http://rhn.redhat.com/errata/RHSA-2013-0995.html - https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU - http://www.exploit-db.com/exploits/27045 - https://bugzilla.redh
.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU - http://www.exploit-db.com/exploits/27045 - https://bugzilla.redhat.com/show_bug.cgi?id=966804
CVE ID: CVE-2013-2122 State: PUBLISHED Published: 2013-07-16T18:00:00 Last Updated: 2024-08-06T15:27:40.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/2007048 - http://seclists.org/fulldisclosure/2013/May/208 - http://www.openwall.com/lists/oss-security/2013/05/29/9 - https://drupal.org/node/2006188 - https://exchange.xforce.ibmcloud.com/vulnerab
ll.com/lists/oss-security/2013/05/29/9 - https://drupal.org/node/2006188 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84630 - http://osvdb.org/93725 - http://www.securityfocus.com/bid/60209 - http://secunia.com/advisories/53556
CVE ID: CVE-2013-2123 State: PUBLISHED Published: 2013-08-28T15:00:00Z Last Updated: 2024-09-17T01:12:17.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attackers to modify the content via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/05/29/9 - https://drupal.org/node/2007122 - https://drupal.org/node/200
http://www.openwall.com/lists/oss-security/2013/05/29/9 - https://drupal.org/node/2007122 - https://drupal.org/node/2007072 - https://drupal.org/node/2007078
CVE ID: CVE-2013-2124 State: PUBLISHED Published: 2014-05-27T15:00:00 Last Updated: 2024-08-06T15:27:40.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q2/431 - https://github.com/libguestfs/libguestfs/commit/fa6a76050d82894365dfe32916903ef7fee3ffcd - https://exchange.xforce.ibmcloud.com/vulnerabilities/85145 - https://www.redhat.com/archives/libguestfs/2013-May/msg00079.html - https://www.redh
bmcloud.com/vulnerabilities/85145 - https://www.redhat.com/archives/libguestfs/2013-May/msg00079.html - https://www.redhat.com/archives/libguestfs/2013-May/msg00080.html - http://osvdb.org/93724 - http://www.securityfocus.com/bid/60205
CVE ID: CVE-2013-2125 State: PUBLISHED Published: 2014-05-27T15:00:00 Last Updated: 2024-08-06T15:27:40.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q2/362 - http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0 - http://secunia.com/advisories/53353 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84388 - http://seclists.org/oss-sec/2013/q2/366 - http://osvdb.org/93495
CVE ID: CVE-2013-2126 State: PUBLISHED Published: 2013-08-14T15:00:00Z Last Updated: 2024-09-17T02:01:31.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/53883 - http://secunia.com/advisories/53547 - http://www.ubuntu.com/usn/USN-1884-1 - http://www.ubuntu.com/usn/USN-1885-1 - http://www.libraw.org
m/advisories/53547 - http://www.ubuntu.com/usn/USN-1884-1 - http://www.ubuntu.com/usn/USN-1885-1 - http://www.libraw.org/news/libraw-0-15-2 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00195.html - https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6 - http://www.openwall.com/lists/oss-security/2013/05/29/7 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00193.html - http://secunia.com/advisories/53938 - http://www.openwall.com/lists/oss-security/2013/06/10/1 - http://secunia.com/advisories/53888
CVE ID: CVE-2013-2127 State: PUBLISHED Published: 2013-08-14T15:00:00Z Last Updated: 2024-09-16T17:59:00.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/53547 - https://github.com/LibRaw/LibRaw/commit/2f912f5b33582961b1cdbd9fd828589f8b78f21d - http://www.openwall.com/lists/oss-security/2013/05/29/7 - http://www.libraw.org/news/libraw-0-15-1
CVE ID: CVE-2013-2128 State: PUBLISHED Published: 2013-06-07T10:00:00 Last Updated: 2024-08-06T15:27:41.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/baff42ab1494528907bf4d5870359e31711746ae - http://www.openwall.com/lists/oss-security/2013/05/29/11 - http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34 - http://rhn.redhat.co
m/lists/oss-security/2013/05/29/11 - http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34 - http://rhn.redhat.com/errata/RHSA-2013-1051.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=baff42ab1494528907bf4d5870359e31711746ae - https://bugzilla.redhat.com/show_bug.cgi?id=968484
CVE ID: CVE-2013-2129 State: PUBLISHED Published: 2013-06-24T16:13:00 Last Updated: 2024-08-06T15:27:40.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/60218 - https://drupal.org/node/2007460 - https://drupal.org/node/2007390 - http://osvdb.org/93749 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84628 -
https://drupal.org/node/2007390 - http://osvdb.org/93749 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84628 - http://secunia.com/advisories/53184
CVE ID: CVE-2013-2130 State: PUBLISHED Published: 2014-06-05T20:00:00 Last Updated: 2024-08-06T15:27:41.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2013-0257.html - http://www.openwall.com/lists/oss-security/2013/05/30/3 - http://secunia.com/advisories/53450 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114172.html - http://www.
a.com/advisories/53450 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114172.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:013 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114144.html - https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28
CVE ID: CVE-2013-2131 State: PUBLISHED Published: 2015-01-04T21:00:00 Last Updated: 2024-08-06T15:27:40.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/04/18/5 - https://bugzilla.redhat.com/show_bug.cgi?id=969296 - https://github.com/oetiker/rrdtool-1.x/pull/397 - http://www.openwall.com/lists/oss-security/2013/05/19/5 - https://github.com/oetiker/rr
m/oetiker/rrdtool-1.x/pull/397 - http://www.openwall.com/lists/oss-security/2013/05/19/5 - https://github.com/oetiker/rrdtool-1.x/issues/396 - http://www.openwall.com/lists/oss-security/2013/05/31/2
CVE ID: CVE-2013-2132 State: PUBLISHED Published: 2013-08-15T17:00:00Z Last Updated: 2024-08-06T15:27:40.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef." Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html - http://ubuntu.com/usn/usn-1897-1 - http://www.osvdb.org/93804 - https://jira.mongodb.org/browse/PYTHON-532 - https://github.com/mongodb/mongo-pytho
897-1 - http://www.osvdb.org/93804 - https://jira.mongodb.org/browse/PYTHON-532 - https://github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2 - http://seclists.org/oss-sec/2013/q2/447 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597 - http://www.debian.org/security/2013/dsa-2705 - http://www.securityfocus.com/bid/60252
CVE ID: CVE-2013-2133 State: PUBLISHED Published: 2013-12-06T17:00:00 Last Updated: 2024-08-06T15:27:40.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2013-1785.html - http://www.securi
http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2013-1785.html - http://www.securitytracker.com/id/1029431 - http://rhn.redhat.com/errata/RHSA-2015-0851.html - http://rhn.redhat.com/errata/RHSA-2013-1784.html - http://rhn.redhat.com/errata/RHSA-2013-1786.html
CVE ID: CVE-2013-2134 State: PUBLISHED Published: 2013-07-16T18:00:00 Last Updated: 2024-08-06T15:27:40.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135. Additional Analyst Notes: - CVE Program Container: References: - http://struts.apache.org/development/2.x/docs/s2-015.html - https://cwiki.apache.org/confluence/display/WW/S2-015 - http://www.securityfocus.com/bid/60346 - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html - http:
tp://www.securityfocus.com/bid/60346 - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html - http://www.securityfocus.com/bid/64758 - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - http://security.gentoo.org/glsa/glsa-201409-04.xml
CVE ID: CVE-2013-2135 State: PUBLISHED Published: 2013-07-16T18:00:00 Last Updated: 2024-08-06T15:27:40.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. Additional Analyst Notes: - CVE Program Container: References: - http://struts.apache.org/development/2.x/docs/s2-015.html - https://cwiki.apache.org/confluence/display/WW/S2-015 - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html - http://www.securityfocus.com/bid/64758 - http://www.oracl
acle.com/technetwork/topics/security/cpuoct2013-1899837.html - http://www.securityfocus.com/bid/64758 - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
CVE ID: CVE-2013-2136 State: PUBLISHED Published: 2013-08-19T23:00:00 Last Updated: 2024-08-06T15:27:40.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/86258 - http://www.securi