Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s.com/bid/66108 - http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html - http://support.apple.com/kb/HT6162 - http://seclists.org/fulldisclosure/2014/Mar/92
CVE ID: CVE-2013-6836 State: PUBLISHED Published: 2013-12-19T02:00:00 Last Updated: 2024-08-06T17:46:23.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-02/msg00018.html - https://git.gnome.org/browse/gnumeric/commit/?id=b5480b69345b3c6d56ee0ed9c9e9880bb2a08cdc - http://www.securityfocus.com/bid/64459 - https://bugzilla.gnome.o
/commit/?id=b5480b69345b3c6d56ee0ed9c9e9880bb2a08cdc - http://www.securityfocus.com/bid/64459 - https://bugzilla.gnome.org/show_bug.cgi?id=712772 - https://projects.gnome.org/gnumeric/announcements/1.12/gnumeric-1.12.9.shtml - http://secunia.com/advisories/56678
CVE ID: CVE-2013-6837 State: PUBLISHED Published: 2013-12-19T02:00:00 Last Updated: 2024-08-06T17:46:23.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.html - http://www.no-margin-for-errors.com/projects/prettyphoto-jquery-lightbox-clone/ - http://themeforest.net/item/udesign-responsive-wordpress-theme/25
rors.com/projects/prettyphoto-jquery-lightbox-clone/ - http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 - http://themeforest.net/forums/thread/security-vulnerability-affecting-prettyphoto-jquery-script/181180 - http://cxsecurity.com/issue/WLB-2013110149 - http://www.perucrack.net/2014/07/haciendo-un-xss-en-plugin-prettyphoto.html - https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbc
CVE ID: CVE-2013-6838 State: PUBLISHED Published: 2014-01-28T00:00:00 Last Updated: 2024-08-06T17:46:23.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key. Additional Analyst Notes: - CVE Program Container: References: - https://xpd.se/advisories/XPD-2013-001.txt - http://seclists.org/fulldisclosure/2014/Jan/103
CVE ID: CVE-2013-6839 State: PUBLISHED Published: 2013-12-13T15:00:00 Last Updated: 2024-08-06T17:46:23.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id]. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56041 - http://www.instantcms.ru/novosti/security-update-1-10-3.html - https://www.htbridge.com/advisory/HTB23185 - http://archives.neohapsis.com/archives/bugtraq/2013-12/0049.html - http://www.securityfocus.com/bid/63842
CVE ID: CVE-2013-6840 State: PUBLISHED Published: 2013-12-10T15:00:00 Last Updated: 2024-08-06T17:46:23.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local users to gain database privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64153 - http://secunia.com/advisories/56010 - https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-568732.pdf
CVE ID: CVE-2013-6852 State: PUBLISHED Published: 2013-11-22T01:00:00Z Last Updated: 2024-09-17T03:38:46.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/28562/
CVE ID: CVE-2013-6853 State: PUBLISHED Published: 2014-01-26T01:00:00 Last Updated: 2024-08-06T17:46:23.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64971 - http://packetstormsecurity.com/files/124800/Y-Toolbar-Cross-Site-Scripting.html - http://www.cloudscan.me/2014/01/cve-2013-6853-stored-xss-in-y-toolbar.html
/124800/Y-Toolbar-Cross-Site-Scripting.html - http://www.cloudscan.me/2014/01/cve-2013-6853-stored-xss-in-y-toolbar.html - http://osvdb.org/102175 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90529
CVE ID: CVE-2013-6858 State: PUBLISHED Published: 2013-11-23T17:00:00 Last Updated: 2024-08-06T17:46:23.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/63787 - http://www.ubuntu.com/usn/USN-2062-1 - https://bugs.launchpad.net/horizon/+bug/1247675 - http://secunia.com/advisories/55770 - http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html - h
bug/1247675 - http://secunia.com/advisories/55770 - http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html - http://secunia.com/advisories/56117
CVE ID: CVE-2013-6859 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-16T18:45:24.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537 - https://service.sap.com/sap/support/notes/1849356
CVE ID: CVE-2013-6860 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-16T18:03:57.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://service.sap.com/sap/support/notes/1887341 - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6861 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-16T22:39:53.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://service.sap.com/sap/support/notes/1809246 - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6862 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-17T00:31:16.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.sybase.com/detail?id=1099371 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6863 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-17T03:52:37.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://service.sap.com/sap/support/notes/1893440 - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6864 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-16T23:41:09.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to affect confidentiality, integrity, and availability via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://service.sap.com/sap/support/notes/1893556 - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6865 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-17T02:07:07.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR732989. Additional Analyst Notes: - CVE Program Container: References: - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - https://service.sap.com/sap/support/notes/1893558 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6866 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-17T03:54:47.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689. Additional Analyst Notes: - CVE Program Container: References: - https://service.sap.com/sap/support/notes/1893560 - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6867 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-16T16:43:25.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.sybase.com/detail?id=1099371 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55537 - https://service.sap.com/sap/support/notes/1893561
CVE ID: CVE-2013-6868 State: PUBLISHED Published: 2013-11-23T18:00:00Z Last Updated: 2024-09-17T01:56:41.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.sybase.com/detail?id=1099371 - http://secunia.com/advisories/55537
CVE ID: CVE-2013-6869 State: PUBLISHED Published: 2013-11-23T19:00:00 Last Updated: 2024-08-06T17:53:44.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029352 - https://service.sap.com/sap/support/notes/1783795 - https://erpscan.io/advisories/erpscan-13-017-sap-netweaver-srtt_get_count_before_key_rfc-sql-injection/ - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/55736
CVE ID: CVE-2013-6870 State: PUBLISHED Published: 2013-11-25T19:00:00Z Last Updated: 2024-09-17T01:06:10.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55774 - http://www.splunk.com/view/SP-CAAAJCD - http://www.securitytracker.com/id/1029385
CVE ID: CVE-2013-6872 State: PUBLISHED Published: 2014-01-21T15:00:00 Last Updated: 2024-08-06T17:53:45.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a projectpdf action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64943 - http://osvdb.org/102123 - http://packetstormsecurity.com/files/124777/Collabtive-1.1-SQL-Injection.html - http://www.exploit-db.com/exploits/30946 - http://www.collabtive.o-dyn.de/blog/?p=621#more-621 - http://seclists.org/fulldisclosu
w.exploit-db.com/exploits/30946 - http://www.collabtive.o-dyn.de/blog/?p=621#more-621 - http://seclists.org/fulldisclosure/2014/Jan/72
CVE ID: CVE-2013-6873 State: PUBLISHED Published: 2013-11-26T16:00:00 Last Updated: 2024-08-06T17:53:44.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arbitrary SQL commands via the test_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55752 - http://packetstormsecurity.com/files/124035/testa-sql.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/89082 - http://osvdb.org/99992
CVE ID: CVE-2013-6874 State: PUBLISHED Published: 2013-11-26T16:00:00Z Last Updated: 2024-09-17T04:29:06.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/29777 - http://www.securityfocus.com/bid/63895
CVE ID: CVE-2013-6875 State: PUBLISHED Published: 2013-11-26T16:00:00Z Last Updated: 2024-09-16T20:42:01.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://assets.nagios.com/downloads/nagiosxi/CHANGES-2012.TXT - http://secunia.com/advisories/55695 - http://www.security-assessment.com/files/documents/advisory/NagiosQL%20Core%20Config%20Manager%20SQL%20Injection%20Vulnerability%20Advisory
-assessment.com/files/documents/advisory/NagiosQL%20Core%20Config%20Manager%20SQL%20Injection%20Vulnerability%20Advisory%20-%20DA.pdf
CVE ID: CVE-2013-6876 State: PUBLISHED Published: 2018-04-06T17:00:00 Last Updated: 2024-08-06T17:53:44.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) pty_init_terminal and (2) pipe_init_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the version number was not changed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67789 - http://www.openwall.com/lists/oss-security/2014/06/03/11 - http://www.securityfocus.com/arch
curityfocus.com/bid/67789 - http://www.openwall.com/lists/oss-security/2014/06/03/11 - http://www.securityfocus.com/archive/1/532258/100/0/threaded - http://hmarco.org/bugs/s3dvt_0.2.2-root-shell.html - http://packetstormsecurity.com/files/126887/s3dvt-Privilege-Escalation.html - http://www.securityfocus.com/archive/1/532276/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jun/10
CVE ID: CVE-2013-6877 State: PUBLISHED Published: 2013-12-19T22:00:00 Last Updated: 2024-08-06T17:53:45.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an RMP file, a different vulnerability than CVE-2013-7260. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2013-12/0104.html - http://packetstormsecurity.com/files/124535 - http://www.coresecurity.com/advisories/realplayer-heap-based-buffer-overflow-vu
//packetstormsecurity.com/files/124535 - http://www.coresecurity.com/advisories/realplayer-heap-based-buffer-overflow-vulnerability - http://www.securityfocus.com/bid/64398 - http://service.real.com/realplayer/security/12202013_player/en/
CVE ID: CVE-2013-6878 State: PUBLISHED Published: 2019-11-22T18:20:37 Last Updated: 2024-08-06T17:53:44.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23186
CVE ID: CVE-2013-6879 State: PUBLISHED Published: 2019-11-22T18:20:31 Last Updated: 2024-08-06T17:53:44.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23186
CVE ID: CVE-2013-6880 State: PUBLISHED Published: 2019-11-22T17:37:13 Last Updated: 2024-08-06T17:53:44.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - http://www.7elements.co.uk/news/cve-2013-6880 - http://www.7elements.co.uk/resources/blog/cve-2013-6880-proof-concept - http://archives.neohapsis.com/archives/bugtraq/2013-12/0051.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/89663
CVE ID: CVE-2013-6881 State: PUBLISHED Published: 2014-01-07T17:00:00 Last Updated: 2024-08-06T17:53:45.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55989 - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013jun30a/ - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF
-release-notes-2013jun30a/ - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html - http://seclists.org/fulldisclosure/2013/Dec/80 - http://www.exploit-db.com/exploits/30396 - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a/
CVE ID: CVE-2013-6882 State: PUBLISHED Published: 2013-12-17T16:00:00 Last Updated: 2024-08-06T17:53:44.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject arbitrary web script or HTML via unspecified form fields. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55989 - http://osvdb.org/101000 - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2
m/advisories/55989 - http://osvdb.org/101000 - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html - http://seclists.org/fulldisclosure/2013/Dec/80 - http://www.exploit-db.com/exploits/30396 - http://osvdb.org/100996
CVE ID: CVE-2013-6883 State: PUBLISHED Published: 2013-12-17T16:00:00 Last Updated: 2024-08-06T17:53:44.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55989 - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a - http://www.cru-inc.com/support/software-down
-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013jun30a - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html - http://osvdb.org/100999 - http://seclists.org/fulldisclosure/2013/Dec/80 - http://www.exploit-db.com/exploits/30396
CVE ID: CVE-2013-6884 State: PUBLISHED Published: 2014-01-07T17:00:00 Last Updated: 2024-08-06T17:53:44.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55989 - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013jun30a/ - http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html - http://seclists.
stormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html - http://seclists.org/fulldisclosure/2013/Dec/80 - http://www.exploit-db.com/exploits/30396 - http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a/