Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-4693 State: PUBLISHED Published: 2019-12-27T15:49:41 Last Updated: 2024-08-06T16:52:26.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress Xorbin Digital Flash Clock 1.0 has XSS Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/122223/Xorbin-Digital-Flash-Clock-1.0-For-WordPress-XSS.html
CVE ID: CVE-2013-4694 State: PUBLISHED Published: 2014-04-16T22:00:00 Last Updated: 2024-08-06T16:52:27.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a package with a long Skin directory name. NOTE: a second buffer overflow involving a long GUI Search field to ml_local.dll was also reported. However, since it is only exploitable by the user of the application, this issue would not cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk. Additional
t cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Jul/4 - http://www.exploit-db.com/exploits/26558 - http://forums.winamp.com/showthread.php?t=364291 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85399 - http://osvdb.org/94739 - http://packetstormsecurity.com/files/122239/WinAmp-5.63-Buffer-Overflow.html - http://osvdb.org/94740 - https://www.rcesecurity.com/2013/07/winamp-v5-64-fixes-several-code-execution-vulnerabilities-cve-2013-4694-cve-2013-4695 - http://www.securitytracker.com/id/1030107 - http://packetstormsecurity
ion-vulnerabilities-cve-2013-4694-cve-2013-4695 - http://www.securitytracker.com/id/1030107 - http://packetstormsecurity.com/files/122978 - http://www.securityfocus.com/bid/60883
CVE ID: CVE-2013-4695 State: PUBLISHED Published: 2019-12-27T16:00:20 Last Updated: 2024-08-06T16:52:27.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/26557 - http://www.securitytracker.com/id/1030107
CVE ID: CVE-2013-4696 State: REJECTED Published: 2013-01-28T18:00:00Z Last Updated: 2024-09-17T03:13:49.172Z Description: No description available.
CVE ID: CVE-2013-4697 State: PUBLISHED Published: 2013-07-31T01:00:00Z Last Updated: 2024-09-16T17:59:05.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and 10-01; and Hitachi IT Operations Director 02-50 through 02-50-07, 03-00 through 03-00-12, and 04-00 through 04-00-01 allow remote authenticated users to gain privileges via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: -
nticated users to gain privileges via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-017/index.html - http://jvn.jp/en/jp/JVN00065218/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000076
CVE ID: CVE-2013-4698 State: PUBLISHED Published: 2013-08-16T01:00:00Z Last Updated: 2024-09-17T02:42:32.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000077 - http://cs.cybozu.co.jp/information/20130812up02.php - http://jvn.jp/en/jp/JVN21103639/374951/index.html - http://jvn.jp/en/jp/JVN21103639/index.html
CVE ID: CVE-2013-4699 State: PUBLISHED Published: 2013-08-21T16:00:00Z Last Updated: 2024-09-16T18:23:43.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000078 - http://jvn.jp/en/jp/JVN68156832/index.html
CVE ID: CVE-2013-4700 State: PUBLISHED Published: 2013-08-21T16:00:00Z Last Updated: 2024-09-17T03:42:35.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000079 - http://jvn.jp/en/jp/JVN75084836/index.html
CVE ID: CVE-2013-4701 State: PUBLISHED Published: 2013-08-21T16:00:00 Last Updated: 2024-08-06T16:52:27.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9 - http://lists.opensuse.org/open
- https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000080 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html - http://jvn.jp/en/jp/JVN24713981/index.html
CVE ID: CVE-2013-4702 State: PUBLISHED Published: 2013-08-30T21:00:00 Last Updated: 2024-08-06T16:52:27.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/96756 - http://jvn.jp/en/jp/JVN15973066/index.html - http://www.ec-cube.net/info/weakness/weakness.php?id=50 - http://jvndb.jvn.jp/jvndb/JVND
/en/jp/JVN15973066/index.html - http://www.ec-cube.net/info/weakness/weakness.php?id=50 - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000081 - http://svn.ec-cube.net/open_trac/changeset/22891 - http://www.ec-cube.net/info/weakness/20130829/index.php
CVE ID: CVE-2013-4703 State: PUBLISHED Published: 2013-09-10T10:00:00Z Last Updated: 2024-09-17T01:35:46.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://cs.cybozu.co.jp/information/20130909up11.php - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000082 - http://jvn.jp/en/jp/JVN53014207/index.html
CVE ID: CVE-2013-4704 State: PUBLISHED Published: 2013-09-16T01:00:00Z Last Updated: 2024-09-16T17:39:16.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.chama.ne.jp/cart.htm - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000088 - http://jvn.jp/en/jp/JVN77455005/index.html
CVE ID: CVE-2013-4705 State: PUBLISHED Published: 2013-09-13T10:00:00Z Last Updated: 2024-09-17T01:41:27.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN01094166/index.html - http://www.opera.com/docs/changelogs/unified/1500/ - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000086
CVE ID: CVE-2013-4706 State: PUBLISHED Published: 2013-09-20T15:00:00Z Last Updated: 2024-09-17T02:42:02.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows remote authenticated users to cause a denial of service (reboot) by leveraging login access. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN03082733/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000089
CVE ID: CVE-2013-4707 State: PUBLISHED Published: 2013-09-20T15:00:00Z Last Updated: 2024-09-16T20:27:33.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH implementation on D-Link Japan DES-3810 devices with firmware before R2.20.011 allows remote authenticated users to cause a denial of service (device hang) by leveraging login access. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN70245052/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000090
CVE ID: CVE-2013-4708 State: PUBLISHED Published: 2013-10-01T17:00:00Z Last Updated: 2024-09-17T01:15:57.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PPP Access Concentrator (PPPAC) in Internet Initiative Japan Inc. SEIL/x86 1.00 through 2.80, SEIL/X1 1.00 through 4.30, SEIL/X2 1.00 through 4.30, SEIL/B1 1.00 through 4.30, SEIL/Turbo 1.80 through 2.15, and SEIL/neu 2FE Plus 1.80 through 2.15 generates predictable random numbers, which allows remote attackers to bypass RADIUS authentication by sniffing RADIUS traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.seil.jp/support/security/a01388.html - http://jvn.jp/en/jp/JVN40079308/index.h
ogram Container: References: - http://www.seil.jp/support/security/a01388.html - http://jvn.jp/en/jp/JVN40079308/index.html - http://osvdb.org/97619 - http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000091.html
CVE ID: CVE-2013-4709 State: PUBLISHED Published: 2013-09-20T15:00:00Z Last Updated: 2024-09-16T17:58:50.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware before 2.82, SEIL/X1 with firmware before 4.32, SEIL/X2 with firmware before 4.32, SEIL/B1 with firmware before 4.32, SEIL/Turbo with firmware before 2.16, and SEIL/neu 2FE Plus with firmware before 2.16 allows remote attackers to execute arbitrary code via a crafted L2TP message. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN43152129/index.html - http://www.seil.jp/support/security/a01396.html - http
ainer: References: - http://jvn.jp/en/jp/JVN43152129/index.html - http://www.seil.jp/support/security/a01396.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000092
CVE ID: CVE-2013-4710 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T16:52:27.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN53768697/113349/index.html - http://emobile.jp/products/sh
- CVE Program Container: References: - http://jvn.jp/en/jp/JVN53768697/113349/index.html - http://emobile.jp/products/sh/a01sh/systemsoftware.html - http://jvn.jp/en/jp/JVN53768697/index.html - http://jvn.jp/en/jp/JVN53768697/397327/index.html - http://jvn.jp/en/jp/JVN53768697/995312/index.html - http://openwall.com/lists/oss-security/2014/02/18/11 - http://jvn.jp/en/jp/JVN53768697/995293/index.html - http://jvn.jp/en/jp/JVN53768697/995417/index.html - http://50.56.33.56/blog/?p=314 - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000111
CVE ID: CVE-2013-4711 State: PUBLISHED Published: 2013-10-04T10:00:00Z Last Updated: 2024-09-16T16:27:54.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Accela BizSearch 3.2 on Linux and Solaris allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN33788325/995225/index.html - http://jvn.jp/en/jp/JVN33788325/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000094 - http://www.accelatech.com/support/contents/patch.html
CVE ID: CVE-2013-4712 State: PUBLISHED Published: 2013-10-19T10:00:00Z Last Updated: 2024-09-16T20:26:42.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: I-O DATA DEVICE HDL-A and HDL2-A devices with firmware 1.07 and earlier do not properly manage sessions, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rm2.iobb.net - http://jvn.jp/en/jp/JVN52509236/index.html - http://jvn.jp/en/jp/JVN52509236/225184/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000095
CVE ID: CVE-2013-4713 State: PUBLISHED Published: 2013-11-01T01:00:00Z Last Updated: 2024-09-17T02:48:10.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN74608669/index.html - http://www.ioplaza.jp/shop/contents/rdiskmanual.aspx - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000096
CVE ID: CVE-2013-4714 State: PUBLISHED Published: 2013-11-06T11:00:00Z Last Updated: 2024-09-16T19:10:53.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN81813850/index.html - http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000099
CVE ID: CVE-2013-4715 State: PUBLISHED Published: 2013-11-06T11:00:00Z Last Updated: 2024-09-16T20:57:40.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000100 - http://jvn.jp/en/jp/JVN75720314/index.html - http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware
CVE ID: CVE-2013-4716 State: PUBLISHED Published: 2013-11-08T02:00:00Z Last Updated: 2024-09-16T23:55:39.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Tattyan HP TOWN 5_9_3 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2013-000101 - http://www2s.biglobe.ne.jp/~tatsuji/souko/souko_index.htm - http://jvn.jp/en/jp/JVN12513975/index.html - http://www2s.biglobe.ne.jp/~tatsuji/souko/annnai.html
CVE ID: CVE-2013-4717 State: PUBLISHED Published: 2021-08-09T18:03:00 Last Updated: 2024-08-06T16:52:27.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm. Additional Analyst Notes: - CVE Program Container: References
ccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm. Additional Analyst Notes: - CVE Program Container: References: - https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/
CVE ID: CVE-2013-4718 State: PUBLISHED Published: 2021-08-09T18:03:05 Last Updated: 2024-08-06T16:52:27.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search. Additional Analyst Notes: - CVE Program Container: References: - https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/
CVE ID: CVE-2013-4719 State: PUBLISHED Published: 2013-06-27T20:00:00 Last Updated: 2024-08-06T16:52:27.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/53283 - http://typo3.org/extensions/repository/view/lonewsseo - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/81574
CVE ID: CVE-2013-4720 State: PUBLISHED Published: 2013-06-27T20:00:00 Last Updated: 2024-08-06T16:52:27.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/58054 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82217 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/ - http://typo3.org/extensions/repository/view/wec_discussion - http://osvdb.org/90413
CVE ID: CVE-2013-4721 State: PUBLISHED Published: 2013-06-27T20:00:00 Last Updated: 2024-08-06T16:52:27.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/82218 - http://osvdb.org/90411 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE ID: CVE-2013-4722 State: PUBLISHED Published: 2014-04-25T17:00:00 Last Updated: 2024-08-06T16:52:27.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) url, (3) qstr parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html - http://o
oraCMS.v6.txt - http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html - http://osvdb.org/96661
CVE ID: CVE-2013-4723 State: PUBLISHED Published: 2014-04-25T17:00:00 Last Updated: 2024-08-06T16:52:26.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html - http://osvdb.org/96662
CVE ID: CVE-2013-4724 State: PUBLISHED Published: 2014-06-06T14:00:00 Last Updated: 2024-08-06T16:52:27.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://osvdb.org/96664
CVE ID: CVE-2013-4725 State: PUBLISHED Published: 2014-06-06T14:00:00 Last Updated: 2024-08-06T16:52:26.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://osvdb.org/96664
CVE ID: CVE-2013-4726 State: PUBLISHED Published: 2014-04-25T17:00:00 Last Updated: 2024-08-06T16:52:26.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/96665 - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html
CVE ID: CVE-2013-4727 State: PUBLISHED Published: 2014-06-06T14:00:00 Last Updated: 2024-08-06T16:52:26.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a request to Admin/top.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt - http://osvdb.org/96666