Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-6404 State: PUBLISHED Published: 2013-12-09T11:00:00 Last Updated: 2024-08-06T17:39:01.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/quassel/quassel/commit/a1a24da - http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html - http://www
ithub.com/quassel/quassel/commit/a1a24da - http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html - http://www.openwall.com/lists/oss-security/2013/11/28/8 - http://quassel-irc.org/node/123 - https://exchange.xforce.ibmcloud.com/vulnerabilities/89377 - http://secunia.com/advisories/55640 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html - http://osvdb.org/100432
CVE ID: CVE-2013-6405 State: REJECTED Published: 2014-01-06T11:00:00 Last Updated: 2014-01-08T16:57:00 Description: No description available.
CVE ID: CVE-2013-6406 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2013-6407 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T17:39:01.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0029.html - http://secunia.com/advisories/55542 - https://issues.apache.org/jira/browse/SOLR-3895 - http://www.openwall.com/lists/oss-security/2013/11/29/2 - http://svn.apa
tps://issues.apache.org/jira/browse/SOLR-3895 - http://www.openwall.com/lists/oss-security/2013/11/29/2 - http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup - http://rhn.redhat.com/errata/RHSA-2013-1844.html - http://secunia.com/advisories/59372
CVE ID: CVE-2013-6408 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T17:39:01.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0029.html - http://secunia.com/advi
Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0029.html - http://secunia.com/advisories/55542 - http://www.openwall.com/lists/oss-security/2013/11/29/2 - http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup - http://rhn.redhat.com/errata/RHSA-2013-1844.html - http://secunia.com/advisories/59372 - https://issues.apache.org/jira/browse/SOLR-4881
CVE ID: CVE-2013-6409 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T17:39:01.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/63994 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730691 - https://bitbucket.org/jwilk/adequate/raw/tip/debian/changelog
CVE ID: CVE-2013-6410 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T17:39:01.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64002 - http://www.ubuntu.com/usn/USN-2676-1 - http://www.openwall.com/lists/oss-security/2013/11/29/4 - http://sourceforge.net/mailarchive/forum.php?thread_name=529BAA58.2080401%40uter.be&fo
lists/oss-security/2013/11/29/4 - http://sourceforge.net/mailarchive/forum.php?thread_name=529BAA58.2080401%40uter.be&forum_name=nbd-general - http://www.debian.org/security/2013/dsa-2806
CVE ID: CVE-2013-6411 State: PUBLISHED Published: 2013-12-14T17:00:00 Last Updated: 2024-08-06T17:39:01.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56218 - http://www.securityfocus.com/bid/64003 - https://exchange.xforce.ibmcloud.com/vulnerabilities/89334 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00095.html - http://secunia.com/advisories/55589 - http://v
9334 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00095.html - http://secunia.com/advisories/55589 - http://vcs.openttd.org/svn/changeset/26134 - https://security.openttd.org/en/CVE-2013-6411 - http://seclists.org/oss-sec/2013/q4/375 - http://bugs.openttd.org/task/5820
CVE ID: CVE-2013-6412 State: PUBLISHED Published: 2014-01-23T00:00:00 Last Updated: 2024-08-06T17:39:01.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a "7," which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hercules-team/augeas/pull/58 - http://rhn.redhat.com/errata/RHSA-2014-0044.html - https://bugzilla.redhat.com/show_bug.cgi?id=1034261 - https://github.com/hercul
.redhat.com/errata/RHSA-2014-0044.html - https://bugzilla.redhat.com/show_bug.cgi?id=1034261 - https://github.com/hercules-team/augeas/commit/f5b4fc0c
CVE ID: CVE-2013-6413 State: PUBLISHED Published: 2014-05-19T14:00:00 Last Updated: 2024-08-06T17:39:01.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7384 was assigned for the NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/379 - http://forums.unrealircd.com/viewtopic.php?f=2&t=8221 - http://www.unrealircd.com/txt/unreal3_2_10_2_release_notes.txt - http://secli
.unrealircd.com/viewtopic.php?f=2&t=8221 - http://www.unrealircd.com/txt/unreal3_2_10_2_release_notes.txt - http://seclists.org/oss-sec/2013/q4/383
CVE ID: CVE-2013-6414 State: PUBLISHED Published: 2013-12-07T00:00:00 Last Updated: 2024-08-06T17:39:01.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0008.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html - http://secunia.com/advisories/57836 - http://lists.opensuse.org/opensuse-updates/
ensuse-updates/2013-12/msg00081.html - http://secunia.com/advisories/57836 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html - https://puppet.com/security/cve/cve-2013-6414 - http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://rhn.redhat.com/errata/RHSA-2013-1794.html - http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ - http://www.debian.org
ata/RHSA-2013-1794.html - http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ - http://www.debian.org/security/2014/dsa-2888
CVE ID: CVE-2013-6415 State: PUBLISHED Published: 2013-12-07T00:00:00 Last Updated: 2024-08-06T17:39:01.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0008.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html - https://puppet.com/security/cve/cve-2013-6415 - http://lists.opensuse.org/opensus
ensuse-updates/2013-12/msg00081.html - https://puppet.com/security/cve/cve-2013-6415 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html - http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ - http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://rhn.redhat.com/errata/RHSA-2013-1794.html
ve_been_released/ - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://rhn.redhat.com/errata/RHSA-2013-1794.html - http://www.securityfocus.com/bid/64077 - http://secunia.com/advisories/56093 - http://www.debian.org/security/2014/dsa-2888
CVE ID: CVE-2013-6416 State: PUBLISHED Published: 2013-12-07T00:00:00 Last Updated: 2024-08-06T17:39:01.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute. Additional Analyst Notes: - CVE Program Container: References: - http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ - http://www.securityfocus.com/bid/64071
CVE ID: CVE-2013-6417 State: PUBLISHED Published: 2013-12-07T00:00:00 Last Updated: 2024-08-06T17:39:01.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013
Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0008.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html - http://rhn.redhat.com/errata/RHSA-2014-0469.html - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ - http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html - http://weblog.rubyonrails.org/2013/12/3/Rails
.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html - http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ - http://rhn.redhat.com/errata/RHSA-2013-1794.html - https://puppet.com/security/cve/cve-2013-6417 - http://www.debian.org/security/2014/dsa-2888
CVE ID: CVE-2013-6418 State: PUBLISHED Published: 2014-05-05T17:00:00 Last Updated: 2024-08-06T17:39:01.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/531 - http://sourceforge.net/p/pywbem/mailman/message/31757312/ - http://secunia.com/advisories/58327 - http://www.securityfocus.com/bid/64544 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - https://www.suse.com/support/update/
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - https://www.suse.com/support/update/announcement/2014/suse-su-20140580-1.html - http://sourceforge.net/p/pywbem/code/627/ - https://bugzilla.redhat.com/show_bug.cgi?id=1039801
CVE ID: CVE-2013-6419 State: PUBLISHED Published: 2014-01-07T18:00:00 Last Updated: 2024-08-06T17:39:01.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64250 - https://review.openstack
Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64250 - https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py - http://rhn.redhat.com/errata/RHSA-2014-0091.html - http://rhn.redhat.com/errata/RHSA-2014-0231.html - http://www.openwall.com/lists/oss-security/2013/12/11/8 - https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py - https://bugs.launchpad.net/neutron/+bug/1235450
CVE ID: CVE-2013-6420 State: PUBLISHED Published: 2013-12-17T02:00:00 Last Updated: 2024-08-06T17:39:01.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2013/dsa-2816 - http://git.
itional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2013/dsa-2816 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415 - http://rhn.redhat.com/errata/RHSA-2013-1824.html - https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html - http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21 - http://secunia.com/advisories/59652 - http://www.securityfocus.com/bid/64225 - http://rhn.redhat.com/errata/RHSA-2013-1826.html - http://support.apple.com/kb/HT6150 - http://www.php.net/ChangeLog-5.php - http:
.redhat.com/errata/RHSA-2013-1826.html - http://support.apple.com/kb/HT6150 - http://www.php.net/ChangeLog-5.php - http://rhn.redhat.com/errata/RHSA-2013-1815.html - https://bugzilla.redhat.com/show_bug.cgi?id=1036830 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html - http://rhn.redhat.com/errata/RHSA-2013-1813.html - http://www.securitytracker.com/id/1029472 - https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html - https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 - http://rhn.redhat.com/errata/RHSA-2013-1825.html - http://www.ubuntu.com/usn/USN-2055-1
CVE ID: CVE-2013-6421 State: PUBLISHED Published: 2013-12-12T18:00:00 Last Updated: 2024-08-06T17:39:01.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-12/0077.html - http://www.openwall.com/lists/oss-security/2013/12/03/1 - http://www.openwall.com/lists/oss-security/2013/12/03/6 - http://vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html
CVE ID: CVE-2013-6422 State: PUBLISHED Published: 2013-12-23T22:00:00 Last Updated: 2024-08-06T17:39:01.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://curl.haxx.se/docs/adv_20131217.html - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - https://h20564.www2.hp.com/hpsc/doc/
.html - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 - http://www.debian.org/security/2013/dsa-2824 - http://www.ubuntu.com/usn/USN-2058-1
CVE ID: CVE-2013-6423 State: REJECTED Published: 2022-06-30T20:24:33 Last Updated: 2022-06-30T20:24:33 Description: No description available.
CVE ID: CVE-2013-6424 State: PUBLISHED Published: 2014-01-18T19:00:00 Last Updated: 2024-08-06T17:39:01.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1197921 - http://lists.x.org/archives/xorg-devel/2013-October/037996.html - https://bugs.freedesktop.org/show_bug.cgi?id=67484 - http://www.openwall.com/lists/oss-security/2013/12/04/8 - https://security.gentoo.org/glsa/201701-64 -
ug.cgi?id=67484 - http://www.openwall.com/lists/oss-security/2013/12/04/8 - https://security.gentoo.org/glsa/201701-64 - http://www.debian.org/security/2013/dsa-2822 - http://www.ubuntu.com/usn/USN-2500-1 - https://security.gentoo.org/glsa/201710-30 - http://rhn.redhat.com/errata/RHSA-2013-1868.html - http://www.openwall.com/lists/oss-security/2013/12/03/8 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00127.html
CVE ID: CVE-2013-6425 State: PUBLISHED Published: 2014-01-18T19:00:00 Last Updated: 2024-08-06T17:39:01.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1869.html - http://www.ubuntu.com/usn/USN-2047-1 - https://bugs.freedesktop.org/show_bug.cgi?id=67484 - http://lists.freedesktop.org/archives/pixman/2013-November/003109.html - http://www.openwall.com/
how_bug.cgi?id=67484 - http://lists.freedesktop.org/archives/pixman/2013-November/003109.html - http://www.openwall.com/lists/oss-security/2013/12/04/8 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00005.html - http://lists.opensuse.org/opensuse-updates/2014-01/msg00008.html - http://lists.opensuse.org/opensuse-updates/2014-01/msg00097.html - http://www.debian.org/security/2013/dsa-2823 - http://cgit.freedesktop.org/pixman/commit/?id=5e14da97f16e421d084a9e735be21b1025150f0c - http://lists.opensuse.org/opensuse-updates/2014-01/msg00001.html - http://www.openwall.com/lists/oss-security/2013/12/03/8 - https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1197921
CVE ID: CVE-2013-6426 State: PUBLISHED Published: 2013-12-14T17:00:00 Last Updated: 2024-08-06T17:39:01.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/89658 - http://rhn.redhat.com/errata/RHSA-2014-0090.html - https://bugs.
://exchange.xforce.ibmcloud.com/vulnerabilities/89658 - http://rhn.redhat.com/errata/RHSA-2014-0090.html - https://bugs.launchpad.net/heat/+bug/1256049 - http://www.openwall.com/lists/oss-security/2013/12/11/9 - http://www.securityfocus.com/bid/64243
CVE ID: CVE-2013-6427 State: PUBLISHED Published: 2013-12-09T18:00:00 Last Updated: 2024-08-06T17:39:01.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2085-1 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00087.html - http://openwall.com/lists/oss-security/2013/12/05/2 - http://www.debian.org/security/2013/dsa-2829 - htt
msg00087.html - http://openwall.com/lists/oss-security/2013/12/05/2 - http://www.debian.org/security/2013/dsa-2829 - https://bugzilla.novell.com/show_bug.cgi?id=853405
CVE ID: CVE-2013-6428 State: PUBLISHED Published: 2013-12-14T17:00:00 Last Updated: 2024-08-06T17:39:01.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1256983 - http://rhn.redhat.com/errata/RHSA-2014-0090.html - http://seclists.org/oss-sec/2013/q4/479