Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-4728 State: PUBLISHED Published: 2014-06-06T14:00:00 Last Updated: 2024-08-06T16:52:27.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. (dot dot) in the "l" parameter, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/96667 - http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt
CVE ID: CVE-2013-4729 State: PUBLISHED Published: 2013-07-04T10:00:00Z Last Updated: 2024-09-16T16:28:42.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36 - http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php
CVE ID: CVE-2013-4730 State: PUBLISHED Published: 2014-05-15T14:00:00 Last Updated: 2024-08-06T16:52:27.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/60837 - http://osvdb.org/show/osvdb/94624 - http://www.exploit-db.com/exploits/26471 - http://infosec42.blogspot.com/2013/06/unauthenticated-pcman-ftp-207-buffer.html
CVE ID: CVE-2013-4731 State: PUBLISHED Published: 2013-06-29T21:00:00Z Last Updated: 2024-09-16T16:38:13.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tag_ipPing request, a different vulnerability than CVE-2013-3581. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/932044
CVE ID: CVE-2013-4732 State: PUBLISHED Published: 2013-06-29T21:00:00Z Last Updated: 2024-09-16T17:54:12.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU#662676 states "Monroe Electronics could not reproduce this finding. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.
rences: - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf - http://www.kb.cert.org/vuls/id/662676 - http://www.kb.cert.org/vuls/id/AAMN-98MUK2 - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf
CVE ID: CVE-2013-4733 State: PUBLISHED Published: 2013-06-29T21:00:00Z Last Updated: 2024-09-17T04:04:17.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/AAMN-98MUK2 - http://www.kb.cert.org/vuls/id/662676 - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf - http:
org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf - http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
CVE ID: CVE-2013-4734 State: PUBLISHED Published: 2013-06-29T21:00:00Z Last Updated: 2024-09-17T01:31:37.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/AAMN-98MUK2 - http://www.kb.cert.org/vuls/id/662676 - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604
id/662676 - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf - http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
CVE ID: CVE-2013-4735 State: PUBLISHED Published: 2013-06-29T21:00:00Z Last Updated: 2024-09-17T02:57:08.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 have a default password for an administrative account, which makes it easier for remote attackers to obtain access via an IP network. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/AAMN-98MUK2 - http://www.kb.cert.org/vuls/id/662676 - http://www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-P
/www.kb.cert.org/vuls/id/AAMN-98MU7H - http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf - http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
CVE ID: CVE-2013-4736 State: PUBLISHED Published: 2014-02-10T17:00:00 Last Updated: 2024-08-06T16:52:26.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (system crash) via a large number of commands in an ioctl call, related to (1) camera_v1/gemini/msm_gemini_sync.c, (2) camera_v2/gemini/msm_gemini_sync.c, (3) camera_v2/jpeg_10/msm_jpeg_sync.c, (4) gemini/msm_gemini_sync.c, (5) jpeg_10/msm_jpeg_sync.c, and (6) mercury/
nc.c, (3) camera_v2/jpeg_10/msm_jpeg_sync.c, (4) gemini/msm_gemini_sync.c, (5) jpeg_10/msm_jpeg_sync.c, and (6) mercury/msm_mercury_sync.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/projects/security-advisories/integer-overflow-and-signedness-issue-camera-jpeg-engines-cve-2013-4736
CVE ID: CVE-2013-4737 State: PUBLISHED Published: 2014-02-15T11:00:00 Last Updated: 2024-08-06T16:52:27.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly consider certain memory sections, which makes it easier for attackers to bypass intended access restrictions by leveraging the presence of RWX memory at a fixed location. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/projects/security-advisories/configstrictmemoryrwx-not-strictly-enforced-cve-2
References: - https://www.codeaurora.org/projects/security-advisories/configstrictmemoryrwx-not-strictly-enforced-cve-2013-4737
CVE ID: CVE-2013-4738 State: PUBLISHED Published: 2014-02-03T02:00:00 Last Updated: 2024-08-06T16:52:27.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c. Additional Analyst Notes: -
_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739 - http://www.openwall.com/lists/oss-security/2013/10/15/4
CVE ID: CVE-2013-4739 State: PUBLISHED Published: 2014-02-03T02:00:00 Last Updated: 2024-08-06T16:52:26.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via (1) a crafted MSM_MCR_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c, or (2) a crafted MSM_JPEG_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c. Additional Analyst Notes: - CVE Program Container: Ref
to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739 - http://www.openwall.com/lists/oss-security/2013/10/15/4
CVE ID: CVE-2013-4740 State: PUBLISHED Published: 2013-11-12T01:00:00Z Last Updated: 2024-09-17T00:46:15.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, relies on user-space length values for kernel-memory copies of procfs file content, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/11/08/1 - ht
ional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/11/08/1 - https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler - https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05
CVE ID: CVE-2013-4742 State: PUBLISHED Published: 2013-08-09T21:00:00 Last Updated: 2024-08-06T16:52:27.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string within the authentication request. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/54188 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85922 - http://osvdb.org/95582 - http://www.securityfocus.com/bid/61403 - http://archives.neohapsis.com/archives/bugtraq/2013-07/0149.html
CVE ID: CVE-2013-4743 State: PUBLISHED Published: 2019-12-27T16:18:49 Last Updated: 2024-08-06T16:52:27.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static HTTP Server 1.0 has a Local Overflow Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/26520 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85417
CVE ID: CVE-2013-4744 State: PUBLISHED Published: 2013-07-01T21:00:00 Last Updated: 2024-08-06T16:52:27.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001/ - http://typo3.org/extensions/repository/view/phpunit - http://osvdb.org/89132 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81194
CVE ID: CVE-2013-4745 State: PUBLISHED Published: 2013-07-01T23:00:00Z Last Updated: 2024-09-16T18:39:10.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/90410 - http://typo3.org/extensions/repository/view/myquizpoll - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE ID: CVE-2013-4746 State: PUBLISHED Published: 2013-07-01T23:00:00Z Last Updated: 2024-09-16T23:51:08.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/90409 - http://typo3.org/extensions/repository/view/myquizpoll - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE ID: CVE-2013-4747 State: PUBLISHED Published: 2013-07-01T23:00:00 Last Updated: 2024-08-06T16:52:27.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Accessible browse results for indexed search (accessible_is_browse_results) extension 1.2.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/93819 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84674 - http://www.securityfocus.com/bid/60297 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-007/
CVE ID: CVE-2013-4748 State: PUBLISHED Published: 2013-07-01T23:00:00 Last Updated: 2024-08-06T16:52:27.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001/ - http://typo3.org/extensions/repository/view/news - https://exchange.xforce.ibmcloud.com/vulnerabilities/81192 - http://osvdb.org/89134
CVE ID: CVE-2013-4749 State: PUBLISHED Published: 2013-07-01T23:00:00 Last Updated: 2024-08-06T16:52:27.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the UserTask Center, Messaging (sys_messages) extension 1.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/81584 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/
CVE ID: CVE-2013-4751 State: PUBLISHED Published: 2019-11-01T12:33:58 Last Updated: 2024-08-06T16:52:26.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: php-symfony2-Validator has loss of information during serialization Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4751 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.html - http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released - http://www.securityfocus.com/bid/61709 - https://exchange.xforce.ibmcloud.com/vu
-0-24-2-1-12-2-2-5-and-2-3-3-released - http://www.securityfocus.com/bid/61709 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86364
CVE ID: CVE-2013-4752 State: PUBLISHED Published: 2020-01-02T16:07:55 Last Updated: 2024-08-06T16:52:27.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks. Additional Analyst Notes: - CVE Program Container: References: - http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
ogram Container: References: - http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86367 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html - http://www.securityfocus.com/bid/61715 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86365 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86366 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86368 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86369 - http
//exchange.xforce.ibmcloud.com/vulnerabilities/86368 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86369 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86370 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86371 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86372 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86373 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86374
CVE ID: CVE-2013-4753 State: PUBLISHED Published: 2014-12-26T23:00:00 Last Updated: 2024-08-06T16:52:27.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field in an inbox action to messaging/messagebox.php, (2) the "First name" field to auth/profile.php, or (3) the Speakers field in an rqAdd action to calendar/agenda.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.xchg.info/?p=406
CVE ID: CVE-2013-4754 State: PUBLISHED Published: 2014-12-26T23:00:00 Last Updated: 2024-08-06T16:52:27.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field to browse.php or (2) the Title field to prefs.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.xchg.info/?p=400
CVE ID: CVE-2013-4758 State: PUBLISHED Published: 2013-10-04T17:00:00Z Last Updated: 2024-09-16T18:34:27.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/07/05/2 - http://www.rsyslog.com/rsyslog-7-5-2-v7-devel-released/ - http://www.rsyslog.com/rsyslog-7-
/oss-security/2013/07/05/2 - http://www.rsyslog.com/rsyslog-7-5-2-v7-devel-released/ - http://www.rsyslog.com/rsyslog-7-4-2-v7-stable-released/
CVE ID: CVE-2013-4759 State: PUBLISHED Published: 2013-08-09T21:00:00 Last Updated: 2024-08-06T16:52:27.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) fullname, or (3) email parameter to magnoliaPublic/demo-project/members-area/registration.html. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23163 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85940 - http://www.securityfocus.com/bid/61423 - h
isory/HTB23163 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85940 - http://www.securityfocus.com/bid/61423 - http://osvdb.org/95628 - http://archives.neohapsis.com/archives/bugtraq/2013-07/0160.html - http://packetstormsecurity.com/files/122527/Magnolia-CMS-5.0.1-Community-Edition-Cross-Site-Scripting.html
CVE ID: CVE-2013-4761 State: PUBLISHED Published: 2013-08-20T22:00:00 Last Updated: 2024-08-06T16:52:26.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2013/dsa-2761 - http://lists.opensuse.org/opensuse-security-announc
tainer: References: - http://www.debian.org/security/2013/dsa-2761 - http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html - http://puppetlabs.com/security/cve/cve-2013-4761/ - http://rhn.redhat.com/errata/RHSA-2013-1284.html - http://rhn.redhat.com/errata/RHSA-2013-1283.html
CVE ID: CVE-2013-4762 State: PUBLISHED Published: 2013-08-20T22:00:00Z Last Updated: 2024-09-16T21:09:07.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2013-4762/
CVE ID: CVE-2013-4763 State: PUBLISHED Published: 2019-12-27T16:08:15 Last Updated: 2024-08-06T16:52:27.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-07/0108.html - https://www.securityfocus.com/bid/61280
CVE ID: CVE-2013-4764 State: PUBLISHED Published: 2019-12-27T16:11:53 Last Updated: 2024-08-06T16:52:27.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission. Additional Analyst Notes: - CVE Program Container: References: - http://shouji.360.cn/securityReportlist/CVE-2013-4764.html - https://seclists.org/bugtraq/2013/Jul/107
CVE ID: CVE-2013-4766 State: PUBLISHED Published: 2013-09-17T01:00:00Z Last Updated: 2024-09-16T22:34:57.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gather log service in Eucalyptus before 3.3.1 allows remote attackers to read log files via an unspecified request to the (1) Cluster Controller (CC) or (2) Node Controller (NC) component. Additional Analyst Notes: - CVE Program Container: References: - http://www.eucalyptus.com/resources/security/advisories/esa-13