Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
hat.com/errata/RHSA-2013-1436.html - http://www.ubuntu.com/usn/USN-1943-1 - http://www.openwall.com/lists/oss-security/2013/07/23/9 - http://www.securityfocus.com/bid/61411 - http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html - http://www.ubuntu.com/usn/USN-1938-1 - http://www.ubuntu.com/usn/USN-1944-1 - http://www.ubuntu.com/usn/USN-1945-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 - http://rhn.redhat.com/errata/RHSA-2013-1520.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html - https://github.com/torvalds/linux/commit/8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 - http:/
dates/2013-12/msg00129.html - https://github.com/torvalds/linux/commit/8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 - http://www.ubuntu.com/usn/USN-1939-1 - http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html - http://www.ubuntu.com/usn/USN-1947-1 - http://secunia.com/advisories/54148 - http://rhn.redhat.com/errata/RHSA-2013-1460.html - http://www.ubuntu.com/usn/USN-1941-1 - http://secunia.com/advisories/55055 - http://www.ubuntu.com/usn/USN-1942-1 - https://bugzilla.redhat.com/show_bug.cgi?id=987627 - http://www.ubuntu.com/usn/USN-1946-1
CVE ID: CVE-2013-4163 State: PUBLISHED Published: 2013-07-28T18:00:00 Last Updated: 2024-08-06T16:30:50.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1943-1 - http://www.openwall.com/lists/oss-security
- CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1943-1 - http://www.openwall.com/lists/oss-security/2013/07/23/10 - http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html - http://www.ubuntu.com/usn/USN-1938-1 - http://www.securityfocus.com/bid/61412 - http://www.ubuntu.com/usn/USN-1944-1 - http://www.ubuntu.com/usn/USN-1945-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=75a493e60ac4bbe2e977e7129d6d8cbb0dd236be - http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html - https://bugzilla.redhat.com/show_bug.cgi?id=987633 - http://www.ubuntu.com/usn/USN-1947-1 - http://secunia.com/advisories/54148
bugzilla.redhat.com/show_bug.cgi?id=987633 - http://www.ubuntu.com/usn/USN-1947-1 - http://secunia.com/advisories/54148 - http://www.ubuntu.com/usn/USN-1941-1 - http://www.ubuntu.com/usn/USN-1942-1 - https://github.com/torvalds/linux/commit/75a493e60ac4bbe2e977e7129d6d8cbb0dd236be - http://www.ubuntu.com/usn/USN-1946-1
CVE ID: CVE-2013-4164 State: PUBLISHED Published: 2013-11-23T19:00:00 Last Updated: 2024-08-06T16:30:50.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2013-4164 - http://archives.neohapsis.com/arch
CVE Program Container: References: - https://puppet.com/security/cve/cve-2013-4164 - http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00028.html - http://www.ubuntu.com/usn/USN-2035-1 - http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html - http://rhn.redhat.com/errata/RHSA-2014-0215.html - http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00009.html - http://rhn.redhat.com/errata/RHSA-2013-1763.html - http://rhn.redhat.com/errata/RHSA-2013-1764.html - https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released - http://www.securityfocus.com/bid/63873 - https://www.ruby-lang.org/en
g/en/news/2013/11/22/ruby-2-0-0-p353-is-released - http://www.securityfocus.com/bid/63873 - https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164 - http://rhn.redhat.com/errata/RHSA-2013-1767.html - http://rhn.redhat.com/errata/RHSA-2014-0011.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00027.html - https://support.apple.com/kb/HT6536 - http://osvdb.org/100113 - http://www.debian.org/security/2013/dsa-2810 - http://secunia.com/advisories/57376 - https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released - http://www.debian.org/security/2013/dsa-2809 - http://secunia.com/advisories/55787
CVE ID: CVE-2013-4165 State: PUBLISHED Published: 2013-08-01T16:00:00Z Last Updated: 2024-09-16T20:12:33.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bitcoin/bitcoin/issues/2838 - http://openwall.com/lists/oss-security/2013/07/25/5 - https://github.com/bitcoin/bitcoin/pull/2845
CVE ID: CVE-2013-4166 State: PUBLISHED Published: 2020-02-06T14:29:39 Last Updated: 2024-08-06T16:38:00.163Z Vendors: GNOME Products: Evolution, Evolution Data Server Problem Types: Other Description: The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142
iner: References: - https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5 - https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627d - http://seclists.org/oss-sec/2013/q3/191 - https://bugzilla.redhat.com/show_bug.cgi?id=973728 - http://rhn.redhat.com/errata/RHSA-2013-1540.html
CVE ID: CVE-2013-4167 State: PUBLISHED Published: 2013-10-11T22:00:00Z Last Updated: 2024-09-16T21:07:56.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/07/25/7 - http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=66590&p=299356 - http://www.openwall.com/lists/oss-security/2013/07/21/1 - https://twitter.com/LeakFree/status/336942367351394305
CVE ID: CVE-2013-4168 State: PUBLISHED Published: 2019-11-01T19:12:30 Last Updated: 2024-08-06T16:38:01.378Z Vendors: SmokePing Products: SmokePing Problem Types: and end time fields not filtered Description: Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-4168 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4168 - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113987.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114008.html - http://www.openwall.com/lists/oss-security/2
ists.fedoraproject.org/pipermail/package-announce/2013-August/114008.html - http://www.openwall.com/lists/oss-security/2013/07/25/8 - https://github.com/oetiker/SmokePing/commit/bad9f9c28f0939b269f90072aa4cf41f20f15563
CVE ID: CVE-2013-4169 State: PUBLISHED Published: 2013-09-10T19:00:00Z Last Updated: 2024-09-16T19:04:55.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=988498 - http://secunia.com/advisories/54661 - http://rhn.redhat.com/errata/RHSA-2013-1213.html
CVE ID: CVE-2013-4170 State: PUBLISHED Published: 2022-06-30T12:38:42 Last Updated: 2024-08-06T16:38:01.461Z Vendors: n/a Products: ember-source Problem Types: CWE-79 Description: In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `
the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`. Additional Analyst Notes: - CVE Program Container: References: - https://rubysec.com/advisories/CVE-2013-4170/ - https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 - https://groups.google.com/g/ember-security/c/dokLVwwxAdM
CVE ID: CVE-2013-4171 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T16:38:00.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates. Additional Analyst Notes: - CVE Program Container: References: - http://rollerweblogger.org/project/entry/apache_roller_5_0_2 - http://secunia.com/advisories/55862 - http://secunia.com/advisories/55877
CVE ID: CVE-2013-4172 State: PUBLISHED Published: 2013-08-23T16:00:00Z Last Updated: 2024-08-06T16:38:01.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1157.html
CVE ID: CVE-2013-4173 State: PUBLISHED Published: 2013-10-11T22:00:00Z Last Updated: 2024-09-16T23:27:07.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/projects/xymon/files/Xymon/4.3.12/ - http://www.openwall.com/lists/oss-security/2013/07/27/3 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:213
CVE ID: CVE-2013-4174 State: PUBLISHED Published: 2013-08-19T23:00:00 Last Updated: 2024-08-06T16:38:00.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) flash_uri, (2) flash_width, or (3) flash_height in the scald_flash_scald_prerender function in providers/scald_flash/scald_flash.module; or the (4) caption in the scald_image_scald_prerender function in providers/scald_image/scald_image.module. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/95625 - https://drupal.or
mage.module. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/95625 - https://drupal.org/node/2049251 - http://secunia.com/advisories/54144 - https://exchange.xforce.ibmcloud.com/vulnerabilities/85964 - http://drupalcode.org/project/scald.git/commitdiff/32db1ee - http://seclists.org/fulldisclosure/2013/Jul/224 - https://drupal.org/node/2049415 - http://www.securityfocus.com/bid/61426
CVE ID: CVE-2013-4175 State: PUBLISHED Published: 2020-01-23T14:17:42 Last Updated: 2024-08-06T16:38:01.437Z Vendors: MySecureShell Products: MySecureShell Problem Types: denial of service Description: MySecureShell 1.31 has a Local Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/61410 - http://www.openwall.com/lists/oss-security/2013/07/27/5
CVE ID: CVE-2013-4176 State: PUBLISHED Published: 2020-01-23T14:15:45 Last Updated: 2024-08-06T16:38:00.143Z Vendors: mysecureshell Products: mysecureshell Problem Types: Information Disclosure Vulnerability Description: mysecureshell 1.31: Local Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/61409 - http://www.openwall.com/lists/oss-security/2013/07/27/6
CVE ID: CVE-2013-4177 State: PUBLISHED Published: 2014-05-29T14:00:00 Last Updated: 2024-08-06T16:38:01.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1995634 - http://www.securityfocus.com/bid/59884 - https://drupal.org/node/1995706 - https://drupal.org/node/1995482
CVE ID: CVE-2013-4178 State: PUBLISHED Published: 2014-05-29T14:00:00 Last Updated: 2024-08-06T16:38:00.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP). Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1995634 - http://www.securityfocus.com/bid/59884 - https://drupal.org/node/1995706 - https://drupal.org/node/1995482
CVE ID: CVE-2013-4179 State: PUBLISHED Published: 2013-09-16T19:00:00 Last Updated: 2024-08-06T16:38:00.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1199.html - https://bugs.launchpad.net/ossa/+bug/1190229 - http://www.ubuntu.com/usn/USN-2005-1
CVE ID: CVE-2013-4180 State: PUBLISHED Published: 2013-09-16T19:00:00Z Last Updated: 2024-08-06T16:38:01.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1196.html - http://projects.theforeman.org/issues/2860 - http://theforeman.org/manuals/1.2/index.html#Releasenotesfor1.2.2
CVE ID: CVE-2013-4181 State: PUBLISHED Published: 2013-09-16T19:00:00Z Last Updated: 2024-08-06T16:38:01.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=988774 - http://rhn.redhat.com/errata/RHSA-2013-1210.html
CVE ID: CVE-2013-4182 State: PUBLISHED Published: 2013-09-16T19:00:00Z Last Updated: 2024-08-06T16:38:01.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1196.html - https://bugzilla.redhat.com/show_bug.cgi?id=990374 - http://theforeman.org/manuals/1.2/index.html#Releasenotesfor1.2.2 - http://projects.theforeman.org/issues/2863
CVE ID: CVE-2013-4183 State: PUBLISHED Published: 2013-09-16T19:00:00 Last Updated: 2024-08-06T16:38:01.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1198.html - https://bugs.launchpad.net/cinder/+bug/1198185 - http://www.ubuntu.com/usn/USN-2005-1
CVE ID: CVE-2013-4184 State: PUBLISHED Published: 2019-12-10T00:00:00 Last Updated: 2024-08-06T16:38:01.486Z Vendors: libdata-uuid-perl Products: libdata-uuid-perl Problem Types: attacks Description: Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-4184 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-4184 - https://access.redhat.com/security/cve/cve-2013-4184 - https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-4184 - http://www.openwall.com/lists/oss-security/2013/07/31/4 - http://www.securityfocus.com/bid/61534 - https://exchange.xforce.ibmclo
w.openwall.com/lists/oss-security/2013/07/31/4 - http://www.securityfocus.com/bid/61534 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86103 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3F2KOK2SM2LFI4BNFOVV2G2XVJQBIMZL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTKH3TWUOXBAAZST7364UVZ4UPH4CEO7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MATNG5VP46SXJB2JHAI2LXPUXCYUOYPE/
CVE ID: CVE-2013-4185 State: PUBLISHED Published: 2013-10-29T22:00:00Z Last Updated: 2024-08-06T16:38:01.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/nova/+bug/1184041 - http://rhn.redhat.com/errata/RHSA-2013-1199.
ram Container: References: - https://bugs.launchpad.net/nova/+bug/1184041 - http://rhn.redhat.com/errata/RHSA-2013-1199.html - http://seclists.org/oss-sec/2013/q3/282
CVE ID: CVE-2013-4186 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2013-4187 State: PUBLISHED Published: 2020-01-30T20:40:23 Last Updated: 2024-08-06T16:38:01.473Z Vendors: Flippy Products: Flippy Problem Types: Insecure Permissions Description: The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to access content to read a link or alias to a restricted node. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/2054701 - https://drupal.org/node/2050827 - http://www.openwall.com/lists/oss-security/2013/08/10/1 - http://www.openwall.com/lists/oss-security/2013/08/01/1 - http://www.openwall.com/lists/oss-securi
curity/2013/08/10/1 - http://www.openwall.com/lists/oss-security/2013/08/01/1 - http://www.openwall.com/lists/oss-security/2013/08/10/4
CVE ID: CVE-2013-4188 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:38:02.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources." Additional Analyst Notes: - CVE Program Container: References: - http://plone.org/products/plone/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists.org/oss-sec/2013/q3/261 -
0618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists.org/oss-sec/2013/q3/261 - https://bugzilla.redhat.com/show_bug.cgi?id=978449
CVE ID: CVE-2013-4189 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:38:01.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=978450 - http://plone.org/products/plone/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/release
tp://plone.org/products/plone/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists.org/oss-sec/2013/q3/261
CVE ID: CVE-2013-4190 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:38:01.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=978451 - http://plone.org/products/plone/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists
e/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists.org/oss-sec/2013/q3/261
CVE ID: CVE-2013-4191 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:38:01.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive. Additional Analyst Notes: - CVE Program Container: References: - http://plone.org/products/plone/security/advisories/20130618-announcement - http://plone.org/products/plone-hotfix/releases/20130618 - http://seclists.org/oss-sec/2013/q3/261 - https://bugzilla.redhat.com/sho