Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Types: CWE-347 Description: Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsof
does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the
e list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user
acker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an..
ty requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
CVE ID: CVE-2013-3901 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2013-3902 State: PUBLISHED Published: 2013-12-11T00:00:00 Last Updated: 2024-08-06T16:22:01.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1 and Windows 7 SP1 on 64-bit platforms allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-101
CVE ID: CVE-2013-3903 State: PUBLISHED Published: 2013-12-11T00:00:00 Last Updated: 2024-08-06T16:22:01.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to cause a denial of service (reboot) via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-101
CVE ID: CVE-2013-3904 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2013-3905 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka "S/MIME AIA Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-094 - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/re
-updates/securitybulletins/2013/ms13-094 - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19239
CVE ID: CVE-2013-3906 State: PUBLISHED Published: 2013-11-06T11:00:00.000Z Last Updated: 2025-10-22T00:05:40.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2
Container: - CISA ADP Vulnrichment: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096 - http://www.exploit-db.com/exploits/30011 - http://technet.microsoft.com/security/advisory/2896666 - http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx - http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2
CVE ID: CVE-2013-3907 State: PUBLISHED Published: 2013-12-11T00:00:00 Last Updated: 2024-08-06T16:22:01.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: portcls.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Port-Class Driver Double Fetch Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-101
CVE ID: CVE-2013-3908 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information from any visited document via a crafted web page that is not properly handled during a print-preview action, aka "Internet Explorer Information Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecur
rts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18706
CVE ID: CVE-2013-3909 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences, aka "Internet Explorer Information Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Ad
tes/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18342
CVE ID: CVE-2013-3910 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19109 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088
CVE ID: CVE-2013-3911 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19265
CVE ID: CVE-2013-3912 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3916. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19182 - https://docs.microsoft.com/en-us/security-updates/security
itory/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19182 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088
CVE ID: CVE-2013-3913 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2013-3914 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18893
CVE ID: CVE-2013-3915 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3917. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.m
security-updates/securitybulletins/2013/ms13-088 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19243
CVE ID: CVE-2013-3916 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3912. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18488 - https://docs.microsoft.com/en-us/security-updates/security
itory/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18488 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088
CVE ID: CVE-2013-3917 State: PUBLISHED Published: 2013-11-13T00:00:00 Last Updated: 2024-08-06T16:22:01.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3915. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19138 - https://docs.microsoft.com/en-us/security-updates/security
itory/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19138 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088
CVE ID: CVE-2013-3918 State: PUBLISHED Published: 2013-11-12T01:00:00.000Z Last Updated: 2025-10-22T00:05:40.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vu
ge that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.us-cert.gov/ncas/alerts/TA13-317A - http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/ - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 - http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089 - https://isc.sans.edu/forums/diary/16985 - http://blogs.t
ository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089 - https://isc.sans.edu/forums/diary/16985 - http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx
CVE ID: CVE-2013-3919 State: PUBLISHED Published: 2013-06-06T10:00:00 Last Updated: 2024-08-06T16:22:01.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html - https://support.apple.com/kb/HT6536 - https://kb.isc.org/article/AA-00967/
CVE ID: CVE-2013-3920 State: PUBLISHED Published: 2013-11-27T18:00:00 Last Updated: 2024-08-06T16:22:01.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Jahia xCM before 6.6.2 allows remote authenticated users to inject arbitrary web script or HTML via the "about me" field. Additional Analyst Notes: - CVE Program Container: References: - https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-jahia-cve-2013-3920-cve-2013-4617.html
CVE ID: CVE-2013-3921 State: PUBLISHED Published: 2013-12-05T18:00:00 Last Updated: 2024-08-06T16:22:01.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Easytime Studio Easy File Manager 1.1 for iOS allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/spiderlabs/advisories/TWSL2013-033.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/89169
CVE ID: CVE-2013-3922 State: PUBLISHED Published: 2013-11-25T19:00:00 Last Updated: 2024-08-06T16:22:01.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Gummy Bear Studios FTP Drive + HTTP Server 1.0.4 and earlier allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/89161 - https://www.trustwave.com/spiderlabs/advisories/TWSL2013-032.txt
CVE ID: CVE-2013-3923 State: PUBLISHED Published: 2013-11-26T16:00:00 Last Updated: 2024-08-06T16:22:01.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/89172 - https://www.trustwave.com/spiderlabs/advisories/TWSL2013-034.txt
CVE ID: CVE-2013-3925 State: PUBLISHED Published: 2013-07-01T21:00:00Z Last Updated: 2024-09-16T19:37:09.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program Container: References: - http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf - https://jira.atlassian.com/browse/CWD-3366
CVE ID: CVE-2013-3926 State: PUBLISHED Published: 2013-07-01T21:00:00 Last Updated: 2024-08-06T16:22:01.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued. Additional Analyst Notes: - CVE Program Container: Refer
confirm that there is a vulnerability, a patch will be issued. Additional Analyst Notes: - CVE Program Container: References: - http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf - http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd
CVE ID: CVE-2013-3927 State: PUBLISHED Published: 2013-06-18T18:45:00Z Last Updated: 2024-09-17T03:23:27.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-194865.pdf
CVE ID: CVE-2013-3928 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:22:01.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arbitrary code via crafted biPlanes and biBitCount fields in a BMP file. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/86035 - https://docs.google.com/file/d/0BzyiGAtMizMtSFF4ZWVCMHNVVGs/edit?usp=sharing - http://www.jpchacha.com/chasysdraw/help.php?file=history.htm - http://packetstormsecurity.com/files/122810/Chasys-Dra
- http://www.jpchacha.com/chasysdraw/help.php?file=history.htm - http://packetstormsecurity.com/files/122810/Chasys-Draw-IES-Buffer-Overflow.html - http://www.securityfocus.com/bid/61463 - http://secunia.com/advisories/53773 - http://www.exploit-db.com/exploits/27609 - http://longinox.blogspot.com/2013/08/explot-stack-based-overflow-bypassing.html
CVE ID: CVE-2013-3929 State: PUBLISHED Published: 2013-12-09T16:00:00 Last Updated: 2024-08-06T16:22:01.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/53920
CVE ID: CVE-2013-3930 State: PUBLISHED Published: 2014-04-04T14:00:00 Last Updated: 2024-08-06T16:22:01.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Core FTP before 2.2 build 1785 allows remote FTP servers to execute arbitrary code via a crafted directory name in a CWD command reply. Additional Analyst Notes: - CVE Program Container: References: - http://www.coreftp.com/forums/viewtopic.php?t=222102 - http://www.securityfocus.com/bid/61786 - http://osvdb.org/96314 - http://secunia.com/advisories/53743
CVE ID: CVE-2013-3931 State: PUBLISHED Published: 2020-01-02T19:26:27 Last Updated: 2024-08-06T16:22:01.551Z Vendors: Jomres Products: Jomres component for Joomla! Problem Types: Cross-Site Scripting Description: Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the property_name parameter, related to editing property details. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/61634 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86251 - https://www.joomlacorner.com/joomla
tyfocus.com/bid/61634 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86251 - https://www.joomlacorner.com/joomla-news/joomla-vulnerability-news/834-joomla-jomres-component-script-insertion-and-sql-injection-vulnerabilities.html