Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-4302 State: PUBLISHED Published: 2013-10-27T00:00:00 Last Updated: 2024-08-06T16:38:01.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: (1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - https://exchange.xforce.
Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86896 - http://www.debian.org/security/2013/dsa-2753 - http://secunia.com/advisories/54715 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://osvdb.org/96912 - https://www.mediawiki.org/wiki/Release_notes/1.19 - https://www.mediawiki.org/wiki/Release_notes/1.20 - https://bugzilla.wikimedia.org/show_bug.cgi?id=49090 - https://www.mediawiki.org/wiki/Release_notes/1.21
CVE ID: CVE-2013-4303 State: PUBLISHED Published: 2019-12-11T18:30:37 Last Updated: 2024-08-06T16:38:01.957Z Vendors: Wikimedia Foundation Products: MediaWiki Problem Types: Cross-Site Scripting Description: includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-an
.php. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://seclists.org/oss-sec/2013/q3/553 - https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 - http://www.securityfocus.com/bid/62194 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86897
CVE ID: CVE-2013-4304 State: PUBLISHED Published: 2014-01-26T20:00:00 Last Updated: 2024-08-06T16:38:01.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows remote attackers to bypass authentication without a password. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86894 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-S
ps://exchange.xforce.ibmcloud.com/vulnerabilities/86894 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=52338 - http://osvdb.org/96910 - http://secunia.com/advisories/54723
CVE ID: CVE-2013-4305 State: PUBLISHED Published: 2013-10-11T21:00:00 Last Updated: 2024-08-06T16:38:01.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - https://bugzilla.wikimedia.org/show_bug.cgi?id=49070 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://osvdb.org/96909 - https://exchan
://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://osvdb.org/96909 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86890
CVE ID: CVE-2013-4306 State: PUBLISHED Published: 2013-10-11T21:00:00 Last Updated: 2024-08-06T16:38:01.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 - http://list
//git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://www.securityfocus.com/bid/62210 - http://osvdb.org/96908 - https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86893
CVE ID: CVE-2013-4307 State: PUBLISHED Published: 2013-09-11T14:00:00 Last Updated: 2024-08-06T16:38:01.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow (1) remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section or (2) remote administrators to inject arbitrary web script or HTML via a description. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - http://www.securityfocus.com/bi
Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - http://www.securityfocus.com/bid/62201 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - http://osvdb.org/96907 - https://bugzilla.wikimedia.org/show_bug.cgi?id=53472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86892
CVE ID: CVE-2013-4308 State: PUBLISHED Published: 2013-09-11T14:00:00 Last Updated: 2024-08-06T16:38:01.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q3/553 - http://osvdb.org/96906 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - https://exchang
//osvdb.org/96906 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/86891 - http://www.securityfocus.com/bid/62218 - https://bugzilla.wikimedia.org/show_bug.cgi?id=53320
CVE ID: CVE-2013-4309 State: REJECTED Published: 2022-06-30T15:23:48 Last Updated: 2022-06-30T15:23:48 Description: No description available.
CVE ID: CVE-2013-4310 State: PUBLISHED Published: 2013-09-30T21:00:00 Last Updated: 2024-08-06T16:38:01.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-10/0083.html - http://www.securitytracker.com/id/1029077 - http://secunia.com/advisories/54919 - http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html - http://struts.apache.org/release/2.3.x/docs/s2-018.html - http://secunia.com/advisories/56483 - http://www.securityfocus.com/bid/64758
apache.org/release/2.3.x/docs/s2-018.html - http://secunia.com/advisories/56483 - http://www.securityfocus.com/bid/64758 - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - http://secunia.com/advisories/56492
CVE ID: CVE-2013-4311 State: PUBLISHED Published: 2013-10-03T21:00:00 Last Updated: 2024-08-06T16:38:01.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1954-1 - http://wiki.libvirt.org/page/Maintenance_Releases - http://www.openwall.com/lists/oss-security/2013/09/18/6 - http://rhn.redhat
wiki.libvirt.org/page/Maintenance_Releases - http://www.openwall.com/lists/oss-security/2013/09/18/6 - http://rhn.redhat.com/errata/RHSA-2013-1272.html - http://rhn.redhat.com/errata/RHSA-2013-1460.html - http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html - http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html
CVE ID: CVE-2013-4312 State: PUBLISHED Published: 2016-02-08T02:00:00 Last Updated: 2024-08-06T16:38:01.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-0855.html - https://github.com/torvalds/linux/commit/712f4aad406bb1ed67f3f98d04c044191f0ff593 - http://www.ubuntu.com/usn/USN-2967-1 - http://www.kernel.org/pub/linux/kernel/v4
f4aad406bb1ed67f3f98d04c044191f0ff593 - http://www.ubuntu.com/usn/USN-2967-1 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://bugzilla.redhat.com/show_bug.cgi?id=1297813 - http://www.debian.org/security/2016/dsa-3503 - http://www.ubuntu.com/usn/USN-2967-2 - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://rhn.redhat.com/errata/RHSA-2016-2574.html - http://www.securityfocus.com/bid/82986 - http://www.ubuntu.com/usn/USN-2929-1 - http://www.ubuntu.com/usn/USN-2932-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html - https://security-tracker.d
932-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html - https://security-tracker.debian.org/tracker/CVE-2013-4312 - http://www.ubuntu.com/usn/USN-2931-1 - http://www.debian.org/security/2016/dsa-3448 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=712f4aad406bb1ed67f3f98d04c044191f0ff593 - http://www.ubuntu.com/usn/USN-2929-2 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.html
CVE ID: CVE-2013-4313 State: PUBLISHED Published: 2013-09-16T10:00:00Z Last Updated: 2024-09-17T03:14:06.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40676 - https://moodle.org/mod/forum/discuss.php?d=238396
CVE ID: CVE-2013-4314 State: PUBLISHED Published: 2013-09-30T21:00:00 Last Updated: 2024-08-06T16:38:01.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2013/dsa-2763 - https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html - https://bugzilla.redhat.com/
3/dsa-2763 - https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html - https://bugzilla.redhat.com/show_bug.cgi?id=1005325 - http://lists.opensuse.org/opensuse-updates/2013-11/msg00015.html - http://www.openwall.com/lists/oss-security/2013/09/06/2 - http://www.ubuntu.com/usn/USN-1965-1
CVE ID: CVE-2013-4315 State: PUBLISHED Published: 2013-09-16T19:00:00 Last Updated: 2024-08-06T16:38:01.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html - http://secunia.com/advisories/54772 - http://rhn.redhat.com/errata/RHSA-2013-1521.html - https://www.djangoproject.com/weblog/2013/sep/10
m/advisories/54772 - http://rhn.redhat.com/errata/RHSA-2013-1521.html - https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/ - http://secunia.com/advisories/54828 - http://www.debian.org/security/2013/dsa-2755
CVE ID: CVE-2013-4316 State: PUBLISHED Published: 2013-09-30T21:00:00 Last Updated: 2024-08-06T16:38:01.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html - http://struts.apache.org/release/2.3.x/docs/s2-019.html - http://www.securityfocus.com/bid/64758 - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - http://www.securitytracker.com/id/1029078
CVE ID: CVE-2013-4317 State: PUBLISHED Published: 2018-02-06T14:00:00Z Last Updated: 2024-09-17T01:36:03.050Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: Information Disclosure Description: In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2018/q1/1
CVE ID: CVE-2013-4318 State: PUBLISHED Published: 2019-12-26T20:49:22 Last Updated: 2024-08-06T16:38:01.847Z Vendors: Features Products: Features Problem Types: Other Description: File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-4318 - http://www.openwall.com/lists/oss-security/2013/09/09/10
CVE ID: CVE-2013-4319 State: PUBLISHED Published: 2013-10-11T22:00:00Z Last Updated: 2024-08-06T16:38:01.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/09/09/11 - http://www.debian.org/security/2013/dsa-2770 - http://www.supercluster.org/pipermail/torqueusers/2013-September/016098.html - http://www.openwall
urity/2013/dsa-2770 - http://www.supercluster.org/pipermail/torqueusers/2013-September/016098.html - http://www.openwall.com/lists/oss-security/2013/09/09/4
CVE ID: CVE-2013-4320 State: PUBLISHED Published: 2014-05-20T14:00:00 Last Updated: 2024-08-06T16:38:02.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/
CVE ID: CVE-2013-4321 State: PUBLISHED Published: 2014-05-20T14:00:00 Last Updated: 2024-08-06T16:38:01.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/
CVE ID: CVE-2013-4322 State: PUBLISHED Published: 2014-02-26T11:00:00 Last Updated: 2024-08-06T16:38:01.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0008.
ditional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0008.html - http://svn.apache.org/viewvc?view=revision&revision=1549522 - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - https://rhn.redhat.com/errata/RHSA-2014-0686.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 - http://svn.apache.org/viewvc?view=revision&revision=1549523 - http://secunia.com/advisories/59724 - https://bugzilla.redhat.com/show_bug.cgi?id=1069905 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 - http://www.debian.org/security/2016/dsa-3530 - http://tomcat.apache.org/security-7.html - http://www.security
2015:084 - http://www.debian.org/security/2016/dsa-3530 - http://tomcat.apache.org/security-7.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://www-01.ibm.com/support/docview.wss?uid=swg21678113 - http://tomcat.apache.org/security-8.html - http://www-01.ibm.com/support/docview.wss?uid=swg21677147 - http://www-01.ibm.com/support/docview.wss?uid=swg21678231 - http://advisories.mageia.org/MGASA-2014-0148.html - http://secunia.com/advisories/59722 - http://tomcat.apache.org/security-6.html - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 - http://secu
security-6.html - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 - http://secunia.com/advisories/59675 - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://www.ubuntu.com/usn/USN-2130-1 - http://secunia.com/advisories/59873 - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www-01.ibm.com/support/docview.wss?uid=swg21667883 - http://svn.apache.org/viewvc?view=revision&revision=1556540 - http://marc.info/?l=bugtraq&m=144498216801440&w=2 - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html - http://www.securityfocus.com/bid/65767 - http://svn.apache.org/viewvc?view=revision&revision=1521834
014-1972960.html - http://www.securityfocus.com/bid/65767 - http://svn.apache.org/viewvc?view=revision&revision=1521834 - http://www-01.ibm.com/support/docview.wss?uid=swg21675886 - http://svn.apache.org/viewvc?view=revision&revision=1521864 - http://secunia.com/advisories/59036 - https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84
377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2013-4323 State: REJECTED Published: 2022-06-30T20:08:44 Last Updated: 2022-06-30T20:08:44 Description: No description available.
CVE ID: CVE-2013-4324 State: PUBLISHED Published: 2013-10-03T21:00:00 Last Updated: 2024-08-06T16:38:01.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-10/msg00031.html - http://secunia.com/advisories/54947 - http://www.openwall.co
lists.opensuse.org/opensuse-updates/2013-10/msg00031.html - http://secunia.com/advisories/54947 - http://www.openwall.com/lists/oss-security/2013/09/18/6 - http://rhn.redhat.com/errata/RHSA-2013-1273.html - http://www.securityfocus.com/bid/62538
CVE ID: CVE-2013-4325 State: PUBLISHED Published: 2013-09-23T10:00:00 Last Updated: 2024-08-06T16:38:01.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1274.html - http://www.ubuntu.com/usn/USN-1956-1 - http://lists.opensuse.org/
: - http://rhn.redhat.com/errata/RHSA-2013-1274.html - http://www.ubuntu.com/usn/USN-1956-1 - http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.html - https://bugzilla.redhat.com/show_bug.cgi?id=1002375 - http://www.debian.org/security/2013/dsa-2829 - http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=1006674
CVE ID: CVE-2013-4326 State: PUBLISHED Published: 2013-10-03T21:00:00 Last Updated: 2024-08-06T16:38:01.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-10/msg00051.html - http://rhn.redhat.com/errata/RHSA-2013-1282.html - http://www.openwall.com/lists/oss-securit