Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ned to the paintlib issue. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-06/0008.html - http://www.binamuse.com/advisories/BINA-20130521A.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/84723 - http://www.securityfocus.com/bid/60248 - http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html - http://secunia.com/advisories/53635
CVE ID: CVE-2013-3665 State: PUBLISHED Published: 2013-07-18T14:00:00Z Last Updated: 2024-09-17T04:23:51.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Autodesk AutoCAD through 2014, AutoCAD LT through 2014, and DWG TrueView through 2014 allows remote attackers to execute arbitrary code via a crafted DWG file. Additional Analyst Notes: - CVE Program Container: References: - http://usa.autodesk.com/adsk/servlet/ps/dl/item?id=21972896&linkID=9240618&siteID=123112 - http://images.autodesk.com/adsk/files/Autodesk_AutoCAD_Code_Execution_Vulnerability_Hotfix_Readme.pdf
CVE ID: CVE-2013-3666 State: PUBLISHED Published: 2013-05-29T10:00:00Z Last Updated: 2024-09-17T04:14:27.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging mode, using Android Debug Bridge (adb) to establish a USB connection, dialing 3845#*973#, modifying the WLAN Test Wi-Fi Ping Test/User Command tcpdump command string, and pressing the CANCEL button. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/May/166 - https://plus.google.com/110348415484169880343/posts/9KxBt
eferences: - http://seclists.org/fulldisclosure/2013/May/166 - https://plus.google.com/110348415484169880343/posts/9KxBtkyuYcj - http://www.youtube.com/watch?v=ZfbDIpTY-t4
CVE ID: CVE-2013-3667 State: PUBLISHED Published: 2013-12-31T20:00:00 Last Updated: 2024-08-06T16:14:56.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates. Additional Analyst Notes: - CVE Program Container: References: - http://www.barebones.com/support/yojimbo/arch_yojimbo40.html - http://www.barebones.com/support/bbedit/arch_bbedit1055.html - https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03
ww.barebones.com/support/bbedit/arch_bbedit1055.html - https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ - http://www.barebones.com/support/textwrangler/notes_tw453.html
CVE ID: CVE-2013-3670 State: PUBLISHED Published: 2013-06-10T01:00:00Z Last Updated: 2024-09-17T01:56:06.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.g
ny earlier release. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=0baa0a5a02e16ef097ed9f72bc8a7d7b585c7652 - http://ffmpeg.org/security.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c1f2c4c3b49277d65b71ccdd3b6b2878f1b593eb
CVE ID: CVE-2013-3671 State: PUBLISHED Published: 2013-06-10T01:00:00Z Last Updated: 2024-09-16T18:54:34.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7edb984dd051b6919d7d8471c70499273f31b0fa - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=cc0dd86580b3257f22a49
Bh=7edb984dd051b6919d7d8471c70499273f31b0fa - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=cc0dd86580b3257f22a4981a79eb5fa6804182b6 - http://ffmpeg.org/security.html
CVE ID: CVE-2013-3672 State: PUBLISHED Published: 2013-06-10T01:00:00 Last Updated: 2024-08-06T16:14:56.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8d3c99e825317b7efda5fd12e69896b47c700303 - http://www.mandriva.com/security/advisorie
n.org/?p=ffmpeg.git%3Ba=commit%3Bh=8d3c99e825317b7efda5fd12e69896b47c700303 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:227 - http://ffmpeg.org/security.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7fa6db2545643efb4fe2e0bb501fa50af35a6330
CVE ID: CVE-2013-3673 State: PUBLISHED Published: 2013-06-10T01:00:00Z Last Updated: 2024-09-17T03:48:51.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d23b8462b5a4a9da78ed45c4a7a3b35d538df909 - http://ffmpeg.org/security.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ee5e97c46e30fb
7a3b35d538df909 - http://ffmpeg.org/security.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ee5e97c46e30fb3d6f9f78cc3313dbc06528b37
CVE ID: CVE-2013-3674 State: PUBLISHED Published: 2013-06-10T01:00:00 Last Updated: 2024-08-06T16:14:56.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2014:227 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd - http://ffmpeg
2014:227 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd - http://ffmpeg.org/security.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ad002e1a13a8df934bd6cb2c84175a4780ab8942
CVE ID: CVE-2013-3675 State: PUBLISHED Published: 2013-06-10T01:00:00Z Last Updated: 2024-09-16T17:42:57.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=524d0d2cfc7bab1b348f85e7c0369859e63781cf - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=9dd04f6d8cdd1c10c28b2cb4252
d0d2cfc7bab1b348f85e7c0369859e63781cf - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=9dd04f6d8cdd1c10c28b2cb4252c1a41df581915 - http://ffmpeg.org/security.html
CVE ID: CVE-2013-3678 State: PUBLISHED Published: 2014-11-17T16:00:00 Last Updated: 2024-08-06T16:14:56.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71055 - http://www.securityfocus.com/archive/1/533965/100/0/threaded - https://service.sap.com/sap/support/notes/2039348 - http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.
pport/notes/2039348 - http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98637 - http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control - http://seclists.org/fulldisclosure/2014/Nov/25
CVE ID: CVE-2013-3684 State: PUBLISHED Published: 2020-02-11T17:48:40 Last Updated: 2024-08-06T16:14:56.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/85012 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85011
CVE ID: CVE-2013-3685 State: PUBLISHED Published: 2020-02-12T15:41:42 Last Updated: 2024-08-06T16:14:56.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condition in the spritebud daemon, which could let a local malicious user obtain root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/60749 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85296 - https://seclists.org/fulldisclosure/2013/Jun/196 - https://androidvulnerabilities.org/all
CVE ID: CVE-2013-3686 State: PUBLISHED Published: 2013-10-11T21:00:00Z Last Updated: 2024-09-17T01:31:56.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84
CVE ID: CVE-2013-3687 State: PUBLISHED Published: 2013-10-11T21:00:00Z Last Updated: 2024-09-16T20:42:10.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by reading an unspecified backup file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84
CVE ID: CVE-2013-3688 State: PUBLISHED Published: 2013-10-01T19:00:00Z Last Updated: 2024-09-16T17:48:59.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclos
bin/hardfactorydefault. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84 - http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras
CVE ID: CVE-2013-3689 State: PUBLISHED Published: 2013-10-04T23:00:00Z Last Updated: 2024-09-17T03:38:30.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.0.6.16C1 and earlier, do not properly restrict access to configfile.dump, which allow remote attackers to obtain sensitive information (user names, passwords, and configurations) via a get action. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84
CVE ID: CVE-2013-3690 State: PUBLISHED Published: 2013-10-01T19:00:00Z Last Updated: 2024-09-17T04:28:59.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84
CVE ID: CVE-2013-3691 State: PUBLISHED Published: 2019-12-11T18:22:22 Last Updated: 2024-08-06T16:14:56.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jun/84 - https://www.youtube.com/watch?v=2UCAHSVqfuE
CVE ID: CVE-2013-3692 State: PUBLISHED Published: 2013-07-13T10:00:00 Last Updated: 2024-08-06T16:14:56.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass intended access restrictions by leveraging a user's BlackBerry Protect password-reset request and a user's installation of a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.blackberry.com/btsc/KB34458 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85878
CVE ID: CVE-2013-3693 State: PUBLISHED Published: 2013-10-11T22:00:00Z Last Updated: 2024-09-16T23:16:47.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to upload and execute arbitrary packages via a request to port 1098. Additional Analyst Notes: - CVE Program Container: References: - http://btsc.webapps.blackberry.com/btsc/viewdocument.do%3Bjsessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocs
sessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl - http://secunia.com/advisories/55187
CVE ID: CVE-2013-3694 State: PUBLISHED Published: 2013-11-16T02:00:00Z Last Updated: 2024-09-17T02:31:42.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding. Additional Analyst Notes: - CVE Program Container: References: - http://blog.cmpxchg8b.com/2013/11/qnx.html - http://www.blackberry.com/btsc/KB35315
CVE ID: CVE-2013-3697 State: PUBLISHED Published: 2013-07-31T10:00:00Z Last Updated: 2024-09-17T03:48:14.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003 and the NCPL.SYS kernel driver in Novell Client 2 SP2 on Windows Vista and Windows Server 2008 and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 might allow local users to gain privileges via a crafted 0x1439EB IOCTL call. Additional Analyst Notes: - CVE Program Container: References: - http://pastebin.com/RcS2Bucg - http://www.novell.com/support/kb/doc.php?id=7
tes: - CVE Program Container: References: - http://pastebin.com/RcS2Bucg - http://www.novell.com/support/kb/doc.php?id=7012497
CVE ID: CVE-2013-3698 State: REJECTED Published: 2014-01-16T20:00:00 Last Updated: 2014-01-16T19:57:00 Description: No description available.
CVE ID: CVE-2013-3699 State: REJECTED Published: 2014-01-16T20:00:00 Last Updated: 2014-01-16T19:57:00 Description: No description available.
CVE ID: CVE-2013-3701 State: REJECTED Published: 2014-01-16T20:00:00 Last Updated: 2014-01-16T19:57:00 Description: No description available.
CVE ID: CVE-2013-3702 State: REJECTED Published: 2014-01-16T20:00:00 Last Updated: 2014-01-16T19:57:00 Description: No description available.
CVE ID: CVE-2013-3703 State: PUBLISHED Published: 2018-06-08T17:00:00Z Last Updated: 2024-09-17T02:21:03.060Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-862 Description: The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=828256 - https://github.com/openSUSE/open-build-service/commit/06ad7fdbdd7eb2fef8947d14c4cdd00d8f6387b1
CVE ID: CVE-2013-3704 State: PUBLISHED Published: 2013-10-28T22:00:00Z Last Updated: 2024-09-17T00:02:23.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a more-trustworthy key. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-09/msg00022.html - http://lists.opensuse.org/opensuse-updates/2013-09/msg00023.html
CVE ID: CVE-2013-3705 State: PUBLISHED Published: 2013-12-22T15:00:00 Last Updated: 2024-08-06T16:14:56.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/support/kb/doc.php?id=7014276 - http://download.novell.com/Download?buildid=gCT45TxxTHQ~
CVE ID: CVE-2013-3706 State: PUBLISHED Published: 2014-03-06T11:00:00 Last Updated: 2024-08-06T16:14:56.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname, aka ZDI-CAN-1595. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/support/kb/doc.php?id=7014663 - http://www.securityfocus.com/bid/65912
CVE ID: CVE-2013-3707 State: PUBLISHED Published: 2013-12-01T17:00:00 Last Updated: 2024-08-06T16:14:56.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection, which allows remote attackers to cause a denial of service (service crash) by establishing many TCP connections to port 8009. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/support/kb/doc.php?id=7014063
CVE ID: CVE-2013-3708 State: PUBLISHED Published: 2013-12-01T02:00:00 Last Updated: 2024-08-06T16:14:56.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/support/kb/doc.php?id=7014184 - https://bugzilla.novell.com/show_bug.cgi?id=848735
CVE ID: CVE-2013-3709 State: PUBLISHED Published: 2013-12-23T23:00:00 Last Updated: 2024-08-06T16:14:56.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg000
g/opensuse-security-announce/2013-12/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html - https://bugzilla.novell.com/show_bug.cgi?id=851116
CVE ID: CVE-2013-3710 State: PUBLISHED Published: 2013-12-10T15:00:00 Last Updated: 2024-08-06T16:14:56.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere. Additional Analyst Notes: - CVE Program Container: References: - https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html - https://bugzilla.novell.com/show_bug.cgi?id=852101 - http://osvdb.org/100653
CVE ID: CVE-2013-3712 State: PUBLISHED Published: 2014-02-26T15:00:00 Last Updated: 2024-08-06T16:14:56.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has unspecified impact and vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.suse.com/support/update/announcement/2014/suse-su-20140254-1.html - http://secunia.com/advisories/57050
CVE ID: CVE-2013-3713 State: PUBLISHED Published: 2014-01-11T01:00:00 Last Updated: 2024-08-06T16:21:59.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: The image creation configuration in aaa_base before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-12/msg00117.html - https://bugzilla.novell.com/show_bug.cgi?id=843230