Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ontainer: References: - http://wordpress.org/plugins/pretty-link/changelog - http://packetstormsecurity.com/files/121623/Joomla-Jnews-8.0.1-Cross-Site-Scripting.html - https://civicrm.org/advisory/civi-sa-2013-002-openflashchart-xss - http://archives.neohapsis.com/archives/bugtraq/2013-02/0101.html - http://packetstormsecurity.com/files/120433/WordPress-Pretty-Link-1.6.3-Cross-Site-Scripting.html - http://osvdb.org/90435 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82242
CVE ID: CVE-2013-1637 State: PUBLISHED Published: 2013-02-08T11:00:00 Last Updated: 2024-08-06T15:13:31.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events. Additional Analyst Notes: - CVE Program Container: References: - http://www.opera.com/support/kb/view/1042/ - http://www.opera.com/docs/changelogs/unified/1213/ - http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html
CVE ID: CVE-2013-1638 State: PUBLISHED Published: 2013-02-08T11:00:00 Last Updated: 2024-08-06T15:13:32.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document. Additional Analyst Notes: - CVE Program Container: References: - http://www.opera.com/docs/changelogs/unified/1213/ - http://www.opera.com/support/kb/view/1043/ - http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html
CVE ID: CVE-2013-1639 State: PUBLISHED Published: 2013-02-08T11:00:00 Last Updated: 2024-08-06T15:13:31.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request. Additional Analyst Notes: - CVE Program Container: References: - http://www.opera.com/docs/changelogs/unified/1213/ - http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html - http://www.opera.com/support/kb/view/1045/
CVE ID: CVE-2013-1640 State: PUBLISHED Published: 2013-03-20T16:00:00 Last Updated: 2024-08-06T15:13:31.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - h
3-04/msg00004.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - http://secunia.com/advisories/52596 - http://ubuntu.com/usn/usn-1759-1 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html - https://puppetlabs.com/security/cve/cve-2013-1640/
CVE ID: CVE-2013-1641 State: PUBLISHED Published: 2014-10-26T17:00:00 Last Updated: 2024-08-06T15:13:31.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the selitems[] parameter in a download_selected action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md - https://github.com/realtimeprojects/quixplorer - https://exchange.xforce.ibmcloud.com/vulnerabilities/89059 - https://github.com/realtimeprojects/quixplorer
quixplorer - https://exchange.xforce.ibmcloud.com/vulnerabilities/89059 - https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436 - https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt - http://secunia.com/advisories/55725
CVE ID: CVE-2013-1642 State: PUBLISHED Published: 2020-01-02T20:18:34 Last Updated: 2024-08-06T15:13:31.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (2) item, (3) order, (4) searchitem, (5) selitems[], or (6) srt parameter to index.php or (7) the QUERY_STRING to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/realtimeprojects/quixplorer - https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/89056
CVE ID: CVE-2013-1643 State: PUBLISHED Published: 2013-03-06T11:00:00 Last Updated: 2024-08-06T15:13:32.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1761-1 - https://bugs.gentoo.org/sh
Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1761-1 - https://bugs.gentoo.org/show_bug.cgi?id=459904 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8e76d0404b7f664ee6719fd98f0483f0ac4669d6 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:114 - http://secunia.com/advisories/55078 - https://bugzilla.redhat.com/show_bug.cgi?id=918187 - http://www.php.net/ChangeLog-5.php - http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221 - http://rhn.redhat.com/errata/RHSA-2013-1307.html - http://rhn.redhat.com/errata/RHSA-2013-1615.html - http://www.debian.org/security/2013/
com/errata/RHSA-2013-1307.html - http://rhn.redhat.com/errata/RHSA-2013-1615.html - http://www.debian.org/security/2013/dsa-2639 - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101 - http://support.apple.com/kb/HT5880
CVE ID: CVE-2013-1645 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-17T03:28:48.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the publication template path. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1646 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T23:56:01.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via (1) invalid JSON data in a mail-sending POST request, (2) an arbitrary parameter to servlet/TestServlet, (3) a javascript: URL in a standalone-mode action to a UWA module, (4) an infostore attachment, (5) JavaScript code in a contact image, (6) an RSS feed, or (7) a signature. Additional Analyst Notes: - CVE Program Contai
JavaScript code in a contact image, (6) an RSS feed, or (7) a signature. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1647 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T19:15:44.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter, as demonstrated by (1) the location parameter to ajax/redirect or (2) multiple infostore URIs. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1648 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T21:04:26.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bu
SSRF)" issue. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1649 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T19:41:25.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1650 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T17:39:05.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak permissions (group "other" readable) under opt/open-xchange/etc/, which allows local users to obtain sensitive information via standard filesystem operations. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1651 State: PUBLISHED Published: 2013-09-05T10:00:00Z Last Updated: 2024-09-16T17:52:59.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE ID: CVE-2013-1652 State: PUBLISHED Published: 2013-03-20T16:00:00 Last Updated: 2024-08-06T15:13:31.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - http://www.
004.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - http://www.securityfocus.com/bid/58443 - http://secunia.com/advisories/52596 - http://ubuntu.com/usn/usn-1759-1 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html - https://puppetlabs.com/security/cve/cve-2013-1652/
CVE ID: CVE-2013-1653 State: PUBLISHED Published: 2013-03-20T16:00:00 Last Updated: 2024-08-06T15:13:32.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html - http://www.securityfocus.com/bid/58446 - http://www.debian.org/sec
rg/opensuse-security-announce/2013-04/msg00004.html - http://www.securityfocus.com/bid/58446 - http://www.debian.org/security/2013/dsa-2643 - https://puppetlabs.com/security/cve/cve-2013-1653/ - http://secunia.com/advisories/52596 - http://ubuntu.com/usn/usn-1759-1 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
CVE ID: CVE-2013-1654 State: PUBLISHED Published: 2013-03-20T16:00:00 Last Updated: 2024-08-06T15:13:32.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - http://secunia
.html - http://rhn.redhat.com/errata/RHSA-2013-0710.html - http://www.debian.org/security/2013/dsa-2643 - http://secunia.com/advisories/52596 - http://ubuntu.com/usn/usn-1759-1 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html - https://puppetlabs.com/security/cve/cve-2013-1654/ - http://www.securityfocus.com/bid/64758
CVE ID: CVE-2013-1655 State: PUBLISHED Published: 2013-03-20T16:00:00 Last Updated: 2024-08-06T15:13:31.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/58442 - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html - http://www.debian.org/security/2013/dsa-2643 - http://secunia.com/advisories/52596 - https://puppetlabs.com/security/cve/cve-2013-1655/ - http://ubuntu.com/usn/usn-17
http://secunia.com/advisories/52596 - https://puppetlabs.com/security/cve/cve-2013-1655/ - http://ubuntu.com/usn/usn-1759-1 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
CVE ID: CVE-2013-1656 State: PUBLISHED Published: 2013-03-08T18:00:00 Last Updated: 2024-08-06T15:13:32.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize f
parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function. Additional Analyst Notes: - CVE Program Container: References: - http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html - http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed - https://www.conviso.com.br/advisories/CVE-2013-1656.txt
CVE ID: CVE-2013-1659 State: PUBLISHED Published: 2013-02-22T20:00:00Z Last Updated: 2024-09-17T01:10:32.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption) by modifying the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2013-0003.html
CVE ID: CVE-2013-1660 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2013-1661 State: PUBLISHED Published: 2013-09-04T01:00:00Z Last Updated: 2024-09-16T17:08:49.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2013-0011.html
CVE ID: CVE-2013-1662 State: PUBLISHED Published: 2013-08-24T01:00:00Z Last Updated: 2024-09-17T04:29:37.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2013-0010.html - http://blog.cmpxchg8b.com/2013/08/security-debianisms.html
CVE ID: CVE-2013-1664 State: PUBLISHED Published: 2013-04-03T00:00:00 Last Updated: 2024-08-06T15:13:32.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/02/19/4 - http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.
wall.com/lists/oss-security/2013/02/19/4 - http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html - http://rhn.redhat.com/errata/RHSA-2013-0658.html - http://www.openwall.com/lists/oss-security/2013/02/19/2 - http://ubuntu.com/usn/usn-1757-1 - http://rhn.redhat.com/errata/RHSA-2013-0657.html - https://bugs.launchpad.net/nova/+bug/1100282 - http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html - http://rhn.redhat.com/errata/RHSA-2013-0670.html - http://bugs.python.org/issue17239
CVE ID: CVE-2013-1665 State: PUBLISHED Published: 2013-04-03T00:00:00 Last Updated: 2024-08-06T15:13:31.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/02/19/4 - http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html - http://rhn
s-security/2013/02/19/4 - http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html - http://rhn.redhat.com/errata/RHSA-2013-0658.html - http://www.openwall.com/lists/oss-security/2013/02/19/2 - http://ubuntu.com/usn/usn-1757-1 - http://rhn.redhat.com/errata/RHSA-2013-0657.html - http://www.debian.org/security/2013/dsa-2634 - http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html - http://rhn.redhat.com/errata/RHSA-2013-0670.html - http://bugs.python.org/issue17239 - https://bugs.launchpad.net/keystone/+bug/1100279
CVE ID: CVE-2013-1666 State: PUBLISHED Published: 2019-11-01T16:48:00 Last Updated: 2024-08-06T15:13:32.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-1666 - http://www.openwall.com/lists/oss-security/2015/03/24/20 - http://foswiki.org/Support/SecurityAlert-CVE-2013-1666 - https://www.securityfocus.com/archive/1/525733
CVE ID: CVE-2013-1667 State: PUBLISHED Published: 2013-03-12T16:00:00 Last Updated: 2024-08-06T15:13:31.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html - http://secunia.com/advisories/52472 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:113 - https://wiki.mageia.org/en/Support/
advisories/52472 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:113 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0094 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296 - http://secunia.com/advisories/52499 - http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html - http://perl5.git.perl.org/perl.git/commitdiff/d59e31f - http://www.securityfocus.com/bid/58311 - http://osvdb.org/90892 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82598 - http://marc.info/?l=bugtraq&m=137891988921058&w=2 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18771 - http://perl5.git.perl.org/perl.git/commitdiff/9d83
rg/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18771 - http://perl5.git.perl.org/perl.git/commitdiff/9d83adc - http://www.debian.org/security/2013/dsa-2641 - http://marc.info/?l=bugtraq&m=137891988921058&w=2 - http://perl5.git.perl.org/perl.git/commitdiff/6e79fe5 - http://www.ubuntu.com/usn/USN-1770-1 - http://rhn.redhat.com/errata/RHSA-2013-0685.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - https://bugzilla.redhat.com/show_bug.cgi?id=912276 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
CVE ID: CVE-2013-1668 State: PUBLISHED Published: 2014-05-23T14:00:00 Last Updated: 2024-08-06T15:13:31.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/90927 - http://www.coscms.org/blog/view/4/Version-1.822 - http://www.securityfocus.com/bid/58332 - https://www.htbridge.com/advisory/HTB23145 - http://archives.neohapsis.com/archives/bugtraq/2013-03/0033.html - http://www.exploit-db.com/exploits/24629 - https://gith
tp://archives.neohapsis.com/archives/bugtraq/2013-03/0033.html - http://www.exploit-db.com/exploits/24629 - https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c