Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-7382 State: PUBLISHED Published: 2014-05-17T19:00:00Z Last Updated: 2024-09-16T17:58:35.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/ - http://www.openwall.com/lists/oss-security/2013/10/23/10 - http://www.openwall.com/lists/oss-security/2013/10/25/1 - http://www.exploit-db.com/exploits/29513
CVE ID: CVE-2013-7383 State: PUBLISHED Published: 2014-05-20T14:00:00 Last Updated: 2024-08-06T18:09:17.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: x2gocleansessions in X2Go Server before 4.0.0.8 and 4.0.1.x before 4.0.1.10 allows remote authenticated users to gain privileges via unspecified vectors, possibly related to backticks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65001 - http://www.openwall.com/lists/oss-security/2014/05/18/1 - http://permalink.gmane.org/gmane.linux.terminal-server.x2go.announce/83 - http://www.openwall.com/lists/oss-security/2014/05/19/4 - http://security.gentoo.org/glsa/glsa-201405-26.xml
CVE ID: CVE-2013-7384 State: PUBLISHED Published: 2014-05-19T14:00:00Z Last Updated: 2024-09-16T19:51:20.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors, related to SSL. NOTE: this issue was SPLIT from CVE-2013-6413 per ADT2 due to different vulnerability types. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/379 - http://forums.unrealircd.com/viewtopic.php?f=2&t=8221 - http://www.unrealircd.com/txt/unreal3_2_10_2_release_notes.txt - http://seclists.org/oss-sec/2013/q4/383
CVE ID: CVE-2013-7385 State: PUBLISHED Published: 2014-05-19T14:00:00Z Last Updated: 2024-09-16T22:25:13.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7033. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124444
-2013-7033. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124444/LiveZilla-5.1.2.0-Insecure-Password-Storage.html
CVE ID: CVE-2013-7386 State: PUBLISHED Published: 2014-06-02T15:00:00Z Last Updated: 2024-09-16T17:47:59.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/04/28/3 - https://bugzilla.redhat.com/show_bug.cgi?id=957795 - http://lists.fedoraproject.org/pipermail/package-announce/2013-De
- https://bugzilla.redhat.com/show_bug.cgi?id=957795 - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125125.html - http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=99258dcecba8ef36e1ce0fd6e0dacffe53613ac9 - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125128.html
CVE ID: CVE-2013-7387 State: PUBLISHED Published: 2014-06-02T15:00:00Z Last Updated: 2024-09-17T00:56:09.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie. Additional Analyst Notes: - CVE Program Container: References: - http://dle-news.ru/bags/v97/1549-patchi-bezopasnosti-dlya-versii-97.html - http://en.securitylab.ru/lab/PT-2012-53 - http://secunia.com/advisories/51971
CVE ID: CVE-2013-7388 State: PUBLISHED Published: 2014-07-01T17:00:00 Last Updated: 2024-08-06T18:09:16.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP). NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1). Additional Analyst Notes: - CVE Program Container: References: - http://www.binamuse.com/advisories/BINA-20130521B.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/84723 - http://www.securityfocus.com/bid/
ries/BINA-20130521B.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/84723 - http://www.securityfocus.com/bid/60248 - http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html - http://secunia.com/advisories/53635
CVE ID: CVE-2013-7389 State: PUBLISHED Published: 2014-07-07T14:00:00 Last Updated: 2024-08-06T18:09:17.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php. Additional Analyst Notes: - CVE Program Container: References: - http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008 - htt
advisories/20130801-dlink-dir645.txt - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008 - http://osvdb.org/show/osvdb/95953 - http://osvdb.org/show/osvdb/95952 - http://osvdb.org/show/osvdb/95910 - http://www.securityfocus.com/bid/61579
CVE ID: CVE-2013-7390 State: PUBLISHED Published: 2020-01-27T17:33:26 Last Updated: 2024-08-06T18:09:16.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_file_upload.rb - http://seclists.org/fulldisclosure/2013/Nov/130
CVE ID: CVE-2013-7391 State: PUBLISHED Published: 2014-07-19T18:00:00 Last Updated: 2024-08-06T18:09:16.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3) footer of a View. NOTE: this identifier was SPLIT from CVE-2013-4273 per ADT5 due to different researcher organizations. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/08/22/2 - https://drupal.org/node/2065207 - https://drupal.org/node/2065197
CVE ID: CVE-2013-7392 State: PUBLISHED Published: 2014-07-22T14:00:00Z Last Updated: 2024-09-17T03:43:37.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/. Additional Analyst Notes: - CVE Program Container: References: - http://hatriot.github.io/blog/2014/06/29/gitlist-rce/ - https://github.com/klaussilveira/gitlist/issues/395
CVE ID: CVE-2013-7393 State: PUBLISHED Published: 2014-07-28T19:00:00 Last Updated: 2024-08-06T18:09:16.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3). Additional Analyst Notes: - CVE Program Container: References: - https://subversion.apache.org/security/CVE-2013-4262-advisory.txt - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2013-7394 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T18:09:16.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types. Additional Analyst Notes: - CVE Program Container: References: - http://www.splunk.com/view/SP-CAAAH76 - http://zerodayinitiative.com/advisories/ZDI-14-053/
CVE ID: CVE-2013-7395 State: PUBLISHED Published: 2014-08-12T16:00:00Z Last Updated: 2024-09-16T16:52:44.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects). Additional Analyst Notes: - CVE Program Container: References: - http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=25506
CVE ID: CVE-2013-7397 State: PUBLISHED Published: 2015-06-24T16:00:00 Last Updated: 2024-08-06T18:09:16.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.
lyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2015-1176.html - http://rhn.redhat.com/errata/RHSA-2015-0851.html - http://www.securityfocus.com/bid/69316 - https://github.com/AsyncHttpClient/async-http-client/issues/352 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20 - http://openwall.com/lists/oss-security/2014/08/26/1 - http://rhn.redhat.com/errata/RHSA-2015-1551.html - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb258
4ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2013-7398 State: PUBLISHED Published: 2015-06-24T16:00:00 Last Updated: 2024-08-06T18:09:16.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69317 - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2015-1176.html - https://github.com/Async
/rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2015-1176.html - https://github.com/AsyncHttpClient/async-http-client/issues/197 - http://rhn.redhat.com/errata/RHSA-2015-0851.html - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20 - http://openwall.com/lists/oss-security/2014/08/26/1 - http://rhn.redhat.com/errata/RHSA-2015-1551.html - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2013-7400 State: PUBLISHED Published: 2017-12-29T15:00:00 Last Updated: 2024-08-06T18:09:17.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-014/ - https://extensions.typo3.org/extension/direct_mail/ - http://www.openwall.com/lists/oss-security/2014/09/11/4
CVE ID: CVE-2013-7401 State: PUBLISHED Published: 2014-12-19T20:00:00 Last Updated: 2024-08-06T18:09:16.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/09/15/6 - http://security.gentoo.org/glsa/glsa-201409-07.xml - http://osvdb.org/ref/89/c-icap.txt - http://www.osvdb.org/89304 - http://sourceforge.net/p/c-icap/code/1018/ - http://advisories.mageia.
/ref/89/c-icap.txt - http://www.osvdb.org/89304 - http://sourceforge.net/p/c-icap/code/1018/ - http://advisories.mageia.org/MGASA-2014-0530.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:001
CVE ID: CVE-2013-7402 State: PUBLISHED Published: 2014-12-17T19:00:00 Last Updated: 2024-08-06T18:09:16.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61444 - http://www.debian.org/security/2014/dsa-3101 - http://secunia.com/advisories/61381 - http://sourceforge.net/p/c-icap/code/1018/ - http://advisories.mageia.org/MGASA-2014-0530.html - http://seclists.org/oss-sec/2014/q3/603 - http://www.mandriva.com/security/advisories?name=MD
org/MGASA-2014-0530.html - http://seclists.org/oss-sec/2014/q3/603 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:001
CVE ID: CVE-2013-7404 State: PUBLISHED Published: 2015-08-04T10:00:00 Last Updated: 2024-08-06T18:09:16.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: GE Healthcare Discovery NM 750b has a password of 2getin for the insite account for (1) Telnet and (2) FTP, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. Additional Analyst Notes: - CVE Program Container: References: - http://apps.gehealthcare.com/servlet/ClientServlet/5411136-1EN_r3.pdf?REQ=RAA&DIRECTION=5411136-1EN&FILENAME=5411136-1EN_r3.pdf&FILEREV=3&DOCREV_ORG=3 - http://www.forbes.c
411136-1EN_r3.pdf?REQ=RAA&DIRECTION=5411136-1EN&FILENAME=5411136-1EN_r3.pdf&FILEREV=3&DOCREV_ORG=3 - http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/ - https://twitter.com/digitalbond/status/619250429751222277 - https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE ID: CVE-2013-7405 State: PUBLISHED Published: 2015-08-04T10:00:00 Last Updated: 2024-08-06T18:09:16.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ad Hoc Reporting feature in GE Healthcare Centricity DMS 4.2 has a password of Never!Mind for the Administrator user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. Additional Analyst Notes: - CVE Program Container: References: - http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/ - https://twitter.com/digitalbond/status/619250429751222277 - http://apps.gehealthca
ster/2015/07/10/vulnerable-breasts/ - https://twitter.com/digitalbond/status/619250429751222277 - http://apps.gehealthcare.com/servlet/ClientServlet/0908141_DMS+4.2+MTG.pdf?REQ=RAA&DIRECTION=0908141&FILENAME=0908141_DMS%2B4.2%2BMTG.pdf&FILEREV=D&DOCREV_ORG=D
CVE ID: CVE-2013-7406 State: PUBLISHED Published: 2014-10-21T14:00:00 Last Updated: 2024-08-06T18:09:16.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2044173 - http://osvdb.org/95452 - http://www.securityfocus.com/bid/61319 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85818
CVE ID: CVE-2013-7407 State: PUBLISHED Published: 2014-10-22T14:00:00Z Last Updated: 2024-09-17T01:31:20.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2044173
CVE ID: CVE-2013-7408 State: PUBLISHED Published: 2014-10-26T20:00:00Z Last Updated: 2024-09-17T02:16:24.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value. Additional Analyst Notes: - CVE Program Container: References: - http://support.f5.com/kb/en-us/solutions/public/14000/300/sol14334.html - http://www.securityfocus.com/bid/68792
CVE ID: CVE-2013-7409 State: PUBLISHED Published: 2014-10-30T15:00:00 Last Updated: 2024-08-06T18:09:16.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/123986/ALLPlayer-5.6.2-SEH-Buffer-Overflow.html - http://www.securityfocus.com/bid/62926 - http://www.exploit-db.com/exploits/29798 - http://www.exploit-db.com/exploits/29549 - http://www.exploit-db.com/exploits/32041 - http://osvdb.org/sh
ploits/29798 - http://www.exploit-db.com/exploits/29549 - http://www.exploit-db.com/exploits/32041 - http://osvdb.org/show/osvdb/98283 - http://www.exploit-db.com/exploits/32074 - http://packetstormsecurity.com/files/124161/ALLPlayer-5.7-Buffer-Overflow.html - http://www.exploit-db.com/exploits/28855 - http://packetstormsecurity.com/files/125519/ALLPlayer-5.8.1-Buffer-Overflow.html - http://packetstormsecurity.com/files/123554/ALLPlayer-5.6.2-Buffer-Overflow.html
CVE ID: CVE-2013-7416 State: PUBLISHED Published: 2014-12-03T21:00:00 Last Updated: 2024-08-06T18:09:16.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731582 - http://seclists.org/oss-sec/2014/q4/832 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98947 - http://www.securityfocus.com/bid/71323 - http://seclists.org/oss-sec/2014/q4/826 - https://github.com/themoken/canto-curses/commit/2817869f98c54975f31
id/71323 - http://seclists.org/oss-sec/2014/q4/826 - https://github.com/themoken/canto-curses/commit/2817869f98c54975f31e2dd674c1aefa70749cca
CVE ID: CVE-2013-7417 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T18:09:16.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cgi-bin/ipinfo.cgi in IPCop (aka IPCop Firewall) before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. NOTE: this can be used to bypass the cross-site request forgery (CSRF) protection mechanism by setting the Referer. Additional Analyst Notes: - CVE Program Container: References: - http://www.asafety.fr/vuln-exploit-poc/xss-rce-ipcop-2-1-4-remote-command-execution/ - http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Reques
ss-rce-ipcop-2-1-4-remote-command-execution/ - http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://sourceforge.net/p/ipcop/bugs/807/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/99396
CVE ID: CVE-2013-7418 State: PUBLISHED Published: 2015-01-02T22:00:00Z Last Updated: 2024-09-16T22:57:01.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.asafety.fr/vuln-exploit-poc/xss-rce-ipcop-2-1-4-remote-command-execution/ - http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Request-Forgery-Cross-Site-Scrip
command-execution/ - http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://sourceforge.net/p/ipcop/bugs/807/
CVE ID: CVE-2013-7419 State: PUBLISHED Published: 2015-01-09T18:00:00Z Last Updated: 2024-09-16T19:46:03.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124239/WordPress-Js-Multi-Hotel-2.2.1-Cross-Site-Scripting.html
CVE ID: CVE-2013-7420 State: PUBLISHED Published: 2015-01-12T17:00:00 Last Updated: 2024-08-06T18:09:17.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary via a long string in the Text attribute in a TEXTART XML element in an HML file. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-12/0100.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/89871 - http://www.securityfocus.com/bid/88211