Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-0204 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T14:18:09.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-002/
CVE ID: CVE-2013-0205 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-16T20:01:28.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1890216 - http://www.openwall.com/lists/oss-security/2013/01/21/5 - https://drupal.org/node/1890222 - https://drupal.org/node/1890212
CVE ID: CVE-2013-0206 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-16T17:54:31.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1890318 - http://drupalcode.org/project/live_css.git/commitdiff/ef323c8 - http://drupal.org
s: - https://drupal.org/node/1890318 - http://drupalcode.org/project/live_css.git/commitdiff/ef323c8 - http://drupal.org/node/1883978 - http://www.openwall.com/lists/oss-security/2013/01/21/5 - http://drupal.org/node/1883976 - http://drupalcode.org/project/live_css.git/commitdiff/cb7005f
CVE ID: CVE-2013-0207 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-17T04:08:54.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1890566 - https://drupal.org/node/1890538 - http://www.openwall.com/lists/oss-security/2013/01/21/5 - http://drupalcode.org/project/mark_complete.git/commitdiff/a18c7b2
CVE ID: CVE-2013-0208 State: PUBLISHED Published: 2013-02-13T16:00:00 Last Updated: 2024-08-06T14:18:09.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad - http://rhn.redhat.com/errata/RHSA-2013-0208.html - http://secunia.com/advisories/51992 - http://secunia.com/advisories/51963 - https://bugs.launchpad.net/nova/+
208.html - http://secunia.com/advisories/51992 - http://secunia.com/advisories/51963 - https://bugs.launchpad.net/nova/+bug/1069904 - http://www.openwall.com/lists/oss-security/2013/01/29/9 - http://www.securityfocus.com/bid/57613 - https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b - http://www.ubuntu.com/usn/USN-1709-1 - http://osvdb.org/89661 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81697 - https://bugzilla.redhat.com/show_bug.cgi?id=902629
CVE ID: CVE-2013-0209 State: PUBLISHED Published: 2013-01-23T01:00:00Z Last Updated: 2024-09-16T23:35:35.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code. Additional Analyst Notes: - CVE Program Container: References: - http://www.sec-1.com/blog/?p=402 - http://www.movabletype.org/2013/
nalyst Notes: - CVE Program Container: References: - http://www.sec-1.com/blog/?p=402 - http://www.movabletype.org/2013/01/movable_type_438_patch.html - http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt - http://openwall.com/lists/oss-security/2013/01/22/3
CVE ID: CVE-2013-0210 State: PUBLISHED Published: 2014-05-08T14:00:00 Last Updated: 2024-08-06T14:18:09.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands. Additional Analyst Notes: - CVE Program Container: References: - http://theforeman.org/security.html
CVE ID: CVE-2013-0211 State: PUBLISHED Published: 2013-09-30T20:00:00 Last Updated: 2024-08-06T14:18:09.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4 - https://www.
r: References: - https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4 - https://www.freebsd.org/security/advisories/FreeBSD-SA-16:23.libarchive.asc - http://www.mandriva.com/security/advisories?name=MDVSA-2013:147 - http://lists.opensuse.org/opensuse-updates/2015-03/msg00065.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101876.html - http://www.securityfocus.com/bid/58926 - https://bugzilla.redhat.com/show_bug.cgi?id=902998 - http://www.securitytracker.com/id/1035995 - http://www.ubuntu.com/usn/USN-2549-1 - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101687.html - http://lists.fedoraproject.org/piperma
ttp://lists.fedoraproject.org/pipermail/package-announce/2013-April/101687.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101872.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101700.html
CVE ID: CVE-2013-0212 State: PUBLISHED Published: 2013-02-24T21:00:00Z Last Updated: 2024-08-06T14:18:09.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 - https://lists.launchpad.net/openstack/msg2
github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 - https://lists.launchpad.net/openstack/msg20517.html - http://ubuntu.com/usn/usn-1710-1 - https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 - https://bugs.launchpad.net/glance/+bug/1098962 - https://launchpad.net/glance/+milestone/2012.2.3 - http://www.openwall.com/lists/oss-security/2013/01/29/10 - https://bugzilla.redhat.com/show_bug.cgi?id=902964 - http://rhn.redhat.com/errata/RHSA-2013-0209.html - http://secunia.com/advisories/51990 - https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89 - http://secunia.com/advisories/51957
CVE ID: CVE-2013-0213 State: PUBLISHED Published: 2013-02-02T20:00:00 Last Updated: 2024-08-06T14:18:09.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://www.samba.org/samba/security/CVE-2013-0213 - http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html - http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html - http://www.securityfocus.com/bid/57631 - http://lists.opensuse.or
.opensuse.org/opensuse-updates/2013-02/msg00033.html - http://www.securityfocus.com/bid/57631 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 - http://rhn.redhat.com/errata/RHSA-2014-0305.html - http://www.ubuntu.com/usn/USN-2922-1 - http://www.debian.org/security/2013/dsa-2617 - http://rhn.redhat.com/errata/RHSA-2013-1310.html - http://rhn.redhat.com/errata/RHSA-2013-1542.html
CVE ID: CVE-2013-0214 State: PUBLISHED Published: 2013-02-02T20:00:00 Last Updated: 2024-08-06T14:18:09.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html - http://osvdb.org/89627 - http://lists.opensuse.org/opensuse-updates/
/opensuse-security-announce/2013-02/msg00019.html - http://osvdb.org/89627 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html - http://www.securityfocus.com/bid/57631 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html - http://www.samba.org/samba/security/CVE-2013-0214 - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 - http://rhn.redhat.com/errata/RHSA-2014-0305.html - http://www.ubuntu.com/usn/USN-2922-1 - http://www.debian.org/security/2013/dsa-2617 - http://rhn.redhat.com/errata/RHSA-2013-1310.html - http://rhn.redhat.com/errata/RHSA-2013-1
org/security/2013/dsa-2617 - http://rhn.redhat.com/errata/RHSA-2013-1310.html - http://rhn.redhat.com/errata/RHSA-2013-1542.html
CVE ID: CVE-2013-0215 State: PUBLISHED Published: 2013-03-07T02:00:00 Last Updated: 2024-08-06T14:18:09.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55082 - http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=40f9c5e0a6d15b4ca1f6d4ed3a46f0871520e
nia.com/advisories/55082 - http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=40f9c5e0a6d15b4ca1f6d4ed3a46f0871520eab5 - http://security.gentoo.org/glsa/glsa-201309-24.xml - http://openwall.com/lists/oss-security/2013/02/05/10 - http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=61401264eb00fae4ee4efc8e9a5067449283207b
CVE ID: CVE-2013-0216 State: PUBLISHED Published: 2013-02-18T02:00:00 Last Updated: 2024-08-06T14:18:09.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - https://bugzilla.redhat.com/show_bug.cgi?id=910883 - https://github.com/torvalds/linux/commit/48856286b64e4b66ec62b94e504d0b29c1ade664 - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html - http://git.kernel.org/?p=li
d0b29c1ade664 - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=48856286b64e4b66ec62b94e504d0b29c1ade664 - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - http://www.openwall.com/lists/oss-security/2013/02/05/12
CVE ID: CVE-2013-0217 State: PUBLISHED Published: 2013-02-18T02:00:00 Last Updated: 2024-08-06T14:18:09.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - https://bugzilla.redhat.com/show_bug.cgi?id=910883 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d5145d8eb2b9791533ffe4dc003b129b9696c48
ttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d5145d8eb2b9791533ffe4dc003b129b9696c48 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8 - https://github.com/torvalds/linux/commit/7d5145d8eb2b9791533ffe4dc003b129b9696c48 - http://www.openwall.com/lists/oss-security/2013/02/05/12
CVE ID: CVE-2013-0218 State: PUBLISHED Published: 2013-02-05T23:11:00 Last Updated: 2024-08-06T14:18:09.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0206.html - http://www.osvdb.org/89698 - http://secunia.com/advisories/52041 - http://rhn.redhat.com/errata/RHSA-2013-0833.html - htt
ttp://www.osvdb.org/89698 - http://secunia.com/advisories/52041 - http://rhn.redhat.com/errata/RHSA-2013-0833.html - http://rhn.redhat.com/errata/RHSA-2013-0207.html - https://bugzilla.redhat.com/show_bug.cgi?id=903073 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81725 - http://www.securityfocus.com/bid/57652
CVE ID: CVE-2013-0219 State: PUBLISHED Published: 2013-02-24T19:00:00 Last Updated: 2024-08-06T14:18:09.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files. Additional Analyst Notes: - CVE Program Container: References: - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4 - http://secunia.com/advisories/51928 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html - http://rhn.redhat.com/errata/RHSA-2013-0508.ht
.fedoraproject.org/pipermail/package-announce/2013-February/098434.html - http://rhn.redhat.com/errata/RHSA-2013-0508.html - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a - http://rhn.redhat.com/errata/RHSA-2013-1319.html - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047 - http://secunia.com/advisories/52315 - https://fedorahosted.org/sssd/ticket/1782 - http://www.securityfocus.com/bid/57539 - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9 - https://bugzilla.redhat.com/show_bug.cgi?id=884254 - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d91
87b9 - https://bugzilla.redhat.com/show_bug.cgi?id=884254 - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html
CVE ID: CVE-2013-0220 State: PUBLISHED Published: 2013-02-24T19:00:00Z Last Updated: 2024-08-06T14:18:09.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet. Additional Analyst Notes: - CVE Program Container: References: - https://fedorahosted.org/sssd/ticket/1781 - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.
ontainer: References: - https://fedorahosted.org/sssd/ticket/1781 - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4 - http://secunia.com/advisories/51928 - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html - http://rhn.redhat.com/errata/RHSA-2013-0508.html - https://bugzilla.redhat.com/show_bug.cgi?id=884601 - http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325 - http://secunia.com/advisories/52315 - http://www.securityfocus.com/bid/57539 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098
5 - http://www.securityfocus.com/bid/57539 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098613.html
CVE ID: CVE-2013-0221 State: PUBLISHED Published: 2013-11-23T18:00:00 Last Updated: 2024-08-06T14:18:09.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=903464 - http://rhn.redhat.com/errata/RHSA-2013-1652.html - https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i
p://rhn.redhat.com/errata/RHSA-2013-1652.html - https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 - https://bugzilla.novell.com/show_bug.cgi?id=798538
CVE ID: CVE-2013-0222 State: PUBLISHED Published: 2013-11-23T18:00:00 Last Updated: 2024-08-06T14:18:09.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=903465 - http://rhn.redhat.com/errata/RHSA-2013-1652.html - https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 - ht
.html - https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 - https://bugzilla.novell.com/show_bug.cgi?id=796243
CVE ID: CVE-2013-0223 State: PUBLISHED Published: 2013-11-23T18:00:00 Last Updated: 2024-08-06T14:18:09.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1652.html - https://bugzilla.novell.com/show_bug.cgi?id=798541 - https://bugzilla.redhat.com/show_bug.cgi?id=903466 - https://build.opensuse.org/reques
vell.com/show_bug.cgi?id=798541 - https://bugzilla.redhat.com/show_bug.cgi?id=903466 - https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19
CVE ID: CVE-2013-0224 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-16T19:04:39.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1896714 - http://www.openwall.com/lists/oss-security/2013/01/25/4 - https://drupal.org/node/1895234
CVE ID: CVE-2013-0225 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-16T16:27:27.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1896720 - http://drupalcode.org/project/user_relationships.git/commitdiff/b9a4739 - https://drupal.org/node/1896276 - https://drupal.org/node/1896272
g/project/user_relationships.git/commitdiff/b9a4739 - https://drupal.org/node/1896276 - https://drupal.org/node/1896272 - http://www.openwall.com/lists/oss-security/2013/01/25/4 - http://drupalcode.org/project/user_relationships.git/commitdiff/17e94b9
CVE ID: CVE-2013-0226 State: PUBLISHED Published: 2013-03-19T14:00:00 Last Updated: 2024-08-06T14:18:09.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1896752 - http://www.openwall.com/lists/oss-security/2013/01/25/4
CVE ID: CVE-2013-0227 State: PUBLISHED Published: 2013-03-19T14:00:00Z Last Updated: 2024-09-16T18:49:01.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/1896782 - https://drupal.org/node/1896756 - http://www.openwall.com/lists/oss-security/2013/01/25/4 - http://drupalcode.org/project/search_api_sorts.git/commitdiff/f6cbf47