Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-3590 State: PUBLISHED Published: 2013-08-28T01:00:00Z Last Updated: 2024-09-16T22:14:17.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitrary code by uploading an executable file with the image/jpeg content type, and then accessing this file via unspecified vectors, as demonstrated by access to a JSP file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/592942 - http://buddhalabs.com/Advisories/WebAdvisories.html - http://www.searchblox.com/developers-2/change-log
CVE ID: CVE-2013-3591 State: PUBLISHED Published: 2020-02-07T14:15:28 Last Updated: 2024-08-06T16:14:56.578Z Vendors: vTiger CRM Products: vTiger CRM Problem Types: PHP Code Execution Description: vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one - http://www.securityfocus.com/bid/63454 - http://www.exploit-db.com/exploits/29319
CVE ID: CVE-2013-3593 State: PUBLISHED Published: 2013-10-03T10:00:00Z Last Updated: 2024-09-16T19:51:57.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Baramundi Management Suite 7.5 through 8.9 uses cleartext for (1) client-server communication and (2) data storage, which allows remote attackers to obtain sensitive information by sniffing the network, and allows context-dependent attackers to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/392654
CVE ID: CVE-2013-3594 State: PUBLISHED Published: 2014-01-20T02:00:00 Last Updated: 2024-08-06T16:14:56.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH service on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote attackers to cause a denial of service (device reset) or possibly execute arbitrary code by sending many packets to TCP port 22. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/122582 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90595
CVE ID: CVE-2013-3595 State: PUBLISHED Published: 2014-01-20T02:00:00 Last Updated: 2024-08-06T16:14:56.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenManage web application 2.5 build 1.19 on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote authenticated users to cause a denial of service (device reset) via a direct request to an unspecified OSPF URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/122582 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90597
CVE ID: CVE-2013-3596 State: PUBLISHED Published: 2013-09-08T16:00:00 Last Updated: 2024-08-06T16:14:56.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdvancePro Advanceware allows remote authenticated users to obtain sensitive information about arbitrary customers' orders via a modified id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/96801 - http://www.kb.cert.org/vuls/id/704526
CVE ID: CVE-2013-3597 State: PUBLISHED Published: 2013-08-28T01:00:00Z Last Updated: 2024-09-16T18:14:16.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/592942 - http://buddhalabs.com/Advisories/WebAdvisories.html - http://www.searchblox.com/developers-2/change-log
CVE ID: CVE-2013-3598 State: PUBLISHED Published: 2013-08-28T01:00:00 Last Updated: 2024-08-06T16:14:56.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/592942 - http://osvdb.org/96619 - http://buddhalabs.com/Advisories/WebAdvisories.html - http://www.searchblox.com/developers-2/change-log
CVE ID: CVE-2013-3599 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-16T17:19:07.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: userlogin.jsp in Coursemill Learning Management System (LMS) 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3600 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-17T02:06:26.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3601 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-17T02:01:10.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3602 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-16T18:55:14.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3603 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-16T19:24:55.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3604 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-16T20:47:09.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted input. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3605 State: PUBLISHED Published: 2013-09-06T10:00:00Z Last Updated: 2024-09-17T00:31:31.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960908
CVE ID: CVE-2013-3606 State: PUBLISHED Published: 2014-01-20T02:00:00 Last Updated: 2024-08-06T16:14:56.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login page in the GoAhead web server on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote attackers to cause a denial of service (device outage) via a long username. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/122582 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90598
CVE ID: CVE-2013-3607 State: PUBLISHED Published: 2013-09-08T01:00:00 Last Updated: 2024-08-06T16:14:56.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfoc
(2) password field in login.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/62094 - http://www.kb.cert.org/vuls/id/648646 - http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf - https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf - http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 - https://support.citrix.com/article/CTX216642
CVE ID: CVE-2013-3608 State: PUBLISHED Published: 2013-09-08T01:00:00 Last Updated: 2024-08-06T16:14:56.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allows remote authenticated users to execute arbitrary commands via shell metacharacters, as demonstrated by the IP address field in config_date_time.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/648646 - http://www.supermicro.com/products/
otes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/648646 - http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf - https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf - http://www.securityfocus.com/bid/62097 - http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 - https://support.citrix.com/article/CTX216642
CVE ID: CVE-2013-3609 State: PUBLISHED Published: 2013-09-08T01:00:00 Last Updated: 2024-08-06T16:14:56.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function. Additional Analyst Notes: - CVE Program Container: References: - http://www.security
to the PrivilegeCallBack function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/62098 - http://www.kb.cert.org/vuls/id/648646 - http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf - https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf - http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 - https://support.citrix.com/article/CTX216642
CVE ID: CVE-2013-3610 State: PUBLISHED Published: 2013-10-05T10:00:00Z Last Updated: 2024-09-16T17:43:00.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/984366
CVE ID: CVE-2013-3611 State: REJECTED Published: 2013-09-24T10:00:00 Last Updated: 2013-10-11T09:00:00 Description: No description available.
CVE ID: CVE-2013-3612 State: PUBLISHED Published: 2013-09-17T10:00:00Z Last Updated: 2024-09-16T22:44:59.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/800094
CVE ID: CVE-2013-3613 State: PUBLISHED Published: 2013-09-17T10:00:00Z Last Updated: 2024-09-16T18:33:47.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/800094
CVE ID: CVE-2013-3614 State: PUBLISHED Published: 2013-09-17T10:00:00Z Last Updated: 2024-09-17T03:02:59.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/800094
CVE ID: CVE-2013-3615 State: PUBLISHED Published: 2013-09-17T10:00:00Z Last Updated: 2024-09-16T23:26:38.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/800094
CVE ID: CVE-2013-3616 State: PUBLISHED Published: 2013-09-24T10:00:00Z Last Updated: 2024-09-17T00:42:14.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the KnowledgeView Editorial and Management application allows remote attackers to inject arbitrary web script or HTML via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/521348
CVE ID: CVE-2013-3617 State: PUBLISHED Published: 2013-11-02T19:00:00Z Last Updated: 2024-09-17T02:36:55.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats - http://www.kb.cert.org/vuls/id/533894 - http://www.securityfocus.com/bi
sploit/blog/2013/10/30/seven-tricks-and-treats - http://www.kb.cert.org/vuls/id/533894 - http://www.securityfocus.com/bid/63431
CVE ID: CVE-2013-3619 State: PUBLISHED Published: 2020-01-02T17:51:46 Last Updated: 2024-08-06T16:14:56.530Z Vendors: Supermicro Products: IPMI Problem Types: Other Description: Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX216642 - http://support.citrix.com/article/CTX216642 - https://community.rapid7.com/community/metasploi
x.com/article/CTX216642 - http://support.citrix.com/article/CTX216642 - https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities - https://exchange.xforce.ibmcloud.com/vulnerabilities/89044 - https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
CVE ID: CVE-2013-3620 State: PUBLISHED Published: 2020-01-02T17:51:51 Last Updated: 2024-08-06T16:14:56.570Z Vendors: Supermicro Products: IPMI Problem Types: Other Description: Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX216642 - http://support.citrix.com/article/CTX216642 - https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities - https://exchange.xfo
ommunity.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities - https://exchange.xforce.ibmcloud.com/vulnerabilities/89045 - https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
CVE ID: CVE-2013-3621 State: REJECTED Published: 2020-01-02T17:51:54 Last Updated: 2020-01-02T17:51:54 Description: No description available.
CVE ID: CVE-2013-3622 State: PUBLISHED Published: 2013-12-10T16:00:00 Last Updated: 2024-08-06T16:14:56.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allows remote authenticated users to execute arbitrary code via the SID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64259 - https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities - https://support.citrix.com/article/CTX216642
CVE ID: CVE-2013-3623 State: PUBLISHED Published: 2013-12-10T16:00:00 Last Updated: 2024-08-06T16:14:56.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/29666 - http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf - https://community.rapid7.com/community/metaspl
9666 - http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf - https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities - http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 - https://support.citrix.com/article/CTX216642 - http://www.securityfocus.com/bid/63775
CVE ID: CVE-2013-3624 State: PUBLISHED Published: 2013-10-03T10:00:00 Last Updated: 2024-08-06T16:14:56.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OS deployment feature in Baramundi Management Suite 7.5 through 8.9 stores credentials in cleartext on deployed machines, which allows remote attackers to obtain sensitive information by reading a file. NOTE: this ID was also incorrectly mapped to a separate issue in Oracle Outside In, but the correct ID for that issue is CVE-2013-5763. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/392654
CVE ID: CVE-2013-3625 State: PUBLISHED Published: 2013-10-03T10:00:00Z Last Updated: 2024-09-17T01:55:58.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified DLL file in Baramundi Management Suite 7.5 through 8.9 uses a hardcoded encryption key, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/392654
CVE ID: CVE-2013-3626 State: PUBLISHED Published: 2013-11-06T11:00:00Z Last Updated: 2024-09-17T01:55:39.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Session Server in Attachmate Verastream Host Integrator (VHI) 6.0 through 7.5 SP 1 HF 1 allows remote attackers to upload and execute arbitrary files via a crafted message. Additional Analyst Notes: - CVE Program Container: References: - http://support.attachmate.com/techdocs/2700.html - http://www.kb.cert.org/vuls/id/436214
CVE ID: CVE-2013-3627 State: PUBLISHED Published: 2013-10-05T10:00:00Z Last Updated: 2024-09-16T19:52:14.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrameworkService.exe in McAfee Framework Service in McAfee Managed Agent (MA) before 4.5.0.1927 and 4.6 before 4.6.0.3258 allows remote attackers to cause a denial of service (service crash) via a malformed HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/613886 - https://kc.mcafee.com/corporate/index?page=content&id=SB10055
CVE ID: CVE-2013-3628 State: PUBLISHED Published: 2020-02-07T14:19:00 Last Updated: 2024-08-06T16:14:56.579Z Vendors: Zabbix Products: Zabbix Problem Types: Arbitrary Command Execution Vulnerability Description: Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one - http://www.securityfocus.com/bid/63453 - http://www.exploit-db.com/exploits/29321
CVE ID: CVE-2013-3629 State: PUBLISHED Published: 2020-02-07T14:25:36 Last Updated: 2024-08-06T16:14:56.569Z Vendors: ISPConfig Products: ISPConfig Problem Types: PHP Code Execution Description: ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one - http://www.securityfocus.com/bid/63455 - http://www.exploit-db.com/exploits/29322
CVE ID: CVE-2013-3630 State: PUBLISHED Published: 2013-11-01T01:00:00 Last Updated: 2024-08-06T16:14:56.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one - http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-B
2013/10/30/seven-foss-disclosures-part-one - http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html
CVE ID: CVE-2013-3631 State: PUBLISHED Published: 2013-11-02T19:00:00Z Last Updated: 2024-09-16T18:43:55.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/326830 - https://community.rapid7.com/community/metasploit/blog/2013/1