Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-5641 State: PUBLISHED Published: 2013-09-09T17:00:00 Last Updated: 2024-08-06T17:15:21.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: -
ese details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/54534 - http://osvdb.org/96691 - http://seclists.org/bugtraq/2013/Aug/185 - http://secunia.com/advisories/54617 - http://www.debian.org/security/2013/dsa-2749 - http://archives.neohapsis.com/archives/bugtraq/2013-08/0175.html - http://downloads.asterisk.org/pub/security/AST-2013-004.html - http://www.securityfocus.com/bid/62021 - http://www.securitytracker.com/id/1028956 - https://issues.asterisk.org/jira/browse/ASTERISK-21064 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:223
CVE ID: CVE-2013-5642 State: PUBLISHED Published: 2013-09-09T17:00:00 Last Updated: 2024-08-06T17:15:21.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request. Additional Analyst Notes: -
lid SDP that defines a media description before the connection description in a SIP request. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/54534 - http://osvdb.org/96690 - http://downloads.asterisk.org/pub/security/AST-2013-005.html - http://secunia.com/advisories/54617 - http://www.debian.org/security/2013/dsa-2749 - https://issues.asterisk.org/jira/browse/ASTERISK-22007 - http://www.securitytracker.com/id/1028957 - http://www.securityfocus.com/bid/62022 - http://archives.neohapsis.com/archives/bugtraq/2013-08/0174.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:223
CVE ID: CVE-2013-5643 State: REJECTED Published: 2014-06-10T10:00:00 Last Updated: 2014-06-10T04:57:01 Description: No description available.
CVE ID: CVE-2013-5645 State: PUBLISHED Published: 2013-08-29T10:00:00 Last Updated: 2024-08-06T17:15:21.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. Additional Analyst Notes: - CVE Program Container: References: - http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/g
s: - CVE Program Container: References: - http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github - http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github - http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html - http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 - http://trac.roundcube.net/ticket/1489251
CVE ID: CVE-2013-5646 State: PUBLISHED Published: 2013-08-29T10:00:00Z Last Updated: 2024-09-17T01:56:53.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group. Additional Analyst Notes: - CVE Program Container: References: - http://trac.roundcube.net/ticket/1489251
CVE ID: CVE-2013-5647 State: PUBLISHED Published: 2013-08-29T10:00:00Z Last Updated: 2024-09-16T23:31:53.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename. Additional Analyst Notes: - CVE Program Container: References: - http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html
CVE ID: CVE-2013-5648 State: PUBLISHED Published: 2013-08-29T10:00:00Z Last Updated: 2024-09-17T00:21:59.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / (slash) or \ (backslash) in a DDOC file. Additional Analyst Notes: - CVE Program Container: References: - http://www.id.ee/?lang=en&id=34283#3_7_2 - https://bugs.mageia.org/show_bug.cgi?id=11100 - http://svnweb.mageia.org/packages/updates/3/libdigidoc/current/SOURCES/lib
tps://bugs.mageia.org/show_bug.cgi?id=11100 - http://svnweb.mageia.org/packages/updates/3/libdigidoc/current/SOURCES/libdigidoc-3.6.0.0-security-fix-DataFile-name-tag.patch?revision=472660&view=markup - https://bugzilla.redhat.com/show_bug.cgi?id=1002299
CVE ID: CVE-2013-5649 State: PUBLISHED Published: 2013-09-13T10:00:00 Last Updated: 2024-08-06T17:15:21.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow (1) remote attackers to inject arbitrary web script or HTML via vectors involving login pages, and allow (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a support page. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/JSA10589 - http://osvdb.or
page. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/JSA10589 - http://osvdb.org/97240
CVE ID: CVE-2013-5650 State: PUBLISHED Published: 2013-09-16T19:00:00 Last Updated: 2024-08-06T17:15:21.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote attackers to cause a denial of service (device hang) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/97241 - https://exchange.xforce.ibmcloud.com/vulnerabilities/87063 - http
gram Container: References: - http://osvdb.org/97241 - https://exchange.xforce.ibmcloud.com/vulnerabilities/87063 - https://kb.juniper.net/InfoCenter/index?cmid=no&page=content&id=JSA10590 - http://secunia.com/advisories/54776
CVE ID: CVE-2013-5651 State: PUBLISHED Published: 2013-09-30T21:00:00 Last Updated: 2024-08-06T17:15:21.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune. Additional Analyst Notes: - CVE Program Container: References: - http://libvirt.org/news.html - http://secunia.com/advisories/60895 - http://security.gentoo.org/glsa/glsa-201412-04.xml - http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=47b9127e883677a0d60d767030a147450e919a25 - http:/
a-201412-04.xml - http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=47b9127e883677a0d60d767030a147450e919a25 - http://www.ubuntu.com/usn/USN-1954-1 - http://www.openwall.com/lists/oss-security/2013/08/30/1 - https://bugzilla.redhat.com/show_bug.cgi?id=997367 - http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
CVE ID: CVE-2013-5653 State: PUBLISHED Published: 2017-03-07T15:00:00 Last Updated: 2024-08-06T17:15:21.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3691 - http://rhn.redhat.com/errata/RHSA-2017-0013.html - http://rhn.redhat.com/errata/RHSA-2017-0014.html - https://bugzilla.redhat.com/show_bug.cgi?id=1380327 - https://bugs.ghostscript.com/show_bug.cgi?id=697169 - http://www.openwall.com/lists/oss-security/20
bug.cgi?id=1380327 - https://bugs.ghostscript.com/show_bug.cgi?id=697169 - http://www.openwall.com/lists/oss-security/2016/09/29/28 - http://www.securityfocus.com/bid/96497 - http://www.openwall.com/lists/oss-security/2016/09/29/5 - https://bugs.ghostscript.com/show_bug.cgi?id=694724
CVE ID: CVE-2013-5654 State: PUBLISHED Published: 2019-02-15T21:00:00 Last Updated: 2024-08-06T17:15:21.442Z Vendors: YingZhi Products: YingZhi Python Programming Language Problem Types: Arbitrary file upload vulnerability in YingZhi Python Programming Language for iOS Description: Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=94 - http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744
CVE ID: CVE-2013-5655 State: PUBLISHED Published: 2014-05-14T19:00:00 Last Updated: 2024-08-06T17:15:21.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the FTP server in YingZhi Python Programming Language for iOS 1.9 allows remote attackers to read and possibly write arbitrary files via a .. (dot dot) in the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/08/29/8 - http://osvdb.org/96719 - http://www.securityfocus.com/bid/62074 - http://www.openwall.com/lists/oss-security/2013/08/30/2
CVE ID: CVE-2013-5656 State: PUBLISHED Published: 2020-01-07T16:35:23 Last Updated: 2024-08-06T17:15:21.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://realpentesting.blogspot.com.es/p/advisories.html - http://www.exploit-db.com/exploits/25130 - http://seclists.org/fulldisclosure/2013/Sep/8
CVE ID: CVE-2013-5657 State: PUBLISHED Published: 2020-01-07T16:41:30 Last Updated: 2024-08-06T17:15:21.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request Additional Analyst Notes: - CVE Program Container: References: - http://realpentesting.blogspot.com.es/p/advisories.html - http://seclists.org/fulldisclosure/2013/Sep/8 - https://www.securityfocus.com/bid/62112
CVE ID: CVE-2013-5658 State: PUBLISHED Published: 2020-01-07T16:47:11 Last Updated: 2024-08-06T17:15:21.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: AultWare pwStore 2010.8.30.0 has XSS Additional Analyst Notes: - CVE Program Container: References: - http://realpentesting.blogspot.com.es/p/advisories.html - http://seclists.org/fulldisclosure/2013/Sep/8 - https://packetstormsecurity.com/files/123049/PWStore-2010.8.30.0-Cross-Site-Scripting-Denial-Of-Service.html
CVE ID: CVE-2013-5659 State: PUBLISHED Published: 2020-01-27T14:19:26 Last Updated: 2024-08-06T17:15:21.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wiz 5.0.3 has a user mode write access violation Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Sep/8 - http://realpentesting.blogspot.com/p/realpentesting-advisory-title-user-mode.html
CVE ID: CVE-2013-5660 State: PUBLISHED Published: 2014-04-25T17:00:00 Last Updated: 2024-08-06T17:15:21.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Sep/8 - http://realpentesting.blogspot.com.es/p/blog-page_3.html - http://osvdb.org/show/osvdb/92992 - http://packetstormsecurity.com/files/121512/Winarchiver-3.2-Buffer-Overflow.html - http://osvdb.org/ref/92/winarchiver-overflow.txt - http://www.securityfocus.com/bid/59626
CVE ID: CVE-2013-5661 State: PUBLISHED Published: 2019-11-05T18:14:31 Last Updated: 2024-08-06T17:15:21.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cache Poisoning issue exists in DNS Response Rate Limiting. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5661 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5661 - https://security-tracker.debian.org/tracker/CVE-2013-5661
CVE ID: CVE-2013-5663 State: PUBLISHED Published: 2013-08-31T17:00:00 Last Updated: 2024-08-06T17:15:21.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195. Additional Analyst Notes: - CVE Program Container: References: - http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/ - http://pastie.org/pastes/5568186/text - http://cansecwest.com/cs
tonetworks.com/2013/01/app-id-cache-pollution-update/ - http://pastie.org/pastes/5568186/text - http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx - https://security.paloaltonetworks.com/CVE-2013-5663
CVE ID: CVE-2013-5664 State: PUBLISHED Published: 2013-08-31T17:00:00 Last Updated: 2024-08-06T17:15:21.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2013-5664
CVE ID: CVE-2013-5666 State: PUBLISHED Published: 2013-09-23T20:00:00Z Last Updated: 2024-09-16T20:22:52.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sendfile system-call implementation in sys/kern/uipc_syscalls.c in the kernel in FreeBSD 9.2-RC1 and 9.2-RC2 does not properly pad transmissions, which allows local users to obtain sensitive information (kernel memory) via a length greater than the length of the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a11.sendfile.asc - http://osvdb.org/97142 - http://www.securitytracker.com/id/1029013 - http://svnweb.freebsd.org/base?view=revision&re
c - http://osvdb.org/97142 - http://www.securitytracker.com/id/1029013 - http://svnweb.freebsd.org/base?view=revision&revision=255442
CVE ID: CVE-2013-5667 State: PUBLISHED Published: 2014-01-24T02:00:00 Last Updated: 2024-08-06T17:15:21.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.7elements.co.uk/news/cve-2013-5667/ - http://www.7elements.co.uk/resources/blog/multiple-vulnerabilities-thecus-nas/ - http://www.kb.cert.org/vuls/id/105686
CVE ID: CVE-2013-5668 State: PUBLISHED Published: 2014-01-24T02:00:00 Last Updated: 2024-08-06T17:15:21.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content. Additional Analyst Notes: - CVE Program Container: References: - http://www.7elements.co.uk/news/cve-2013-5668/ - http://www.7elements.co.uk/resources/blog/multiple-vulnerabilities-thecus-nas/ - http://www.kb.cert.org/vuls/id/105686
CVE ID: CVE-2013-5669 State: PUBLISHED Published: 2014-01-24T02:00:00 Last Updated: 2024-08-06T17:15:21.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://www.7elements.co.uk/news/cve-2013-5669/ - http://www.7elements.co.uk/resources/blog/multiple-vulnerabilities-thecus-nas/ - http://www.kb.cert.org/vuls/id/105686
CVE ID: CVE-2013-5670 State: PUBLISHED Published: 2013-11-05T18:00:00Z Last Updated: 2024-09-17T01:47:04.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter. Additional Analyst Notes: - CVE Program Container: References: - http://blog.s9y.org/archives/250-Serendipity-1.7.3-released.html - http://www.opensyscom.fr/Actualites/serendipity-xss-vulnerability.html - http://www.openwall.com/lists/oss-security/2013/09/01/3 - http
syscom.fr/Actualites/serendipity-xss-vulnerability.html - http://www.openwall.com/lists/oss-security/2013/09/01/3 - http://www.osvdb.org/87395 - http://www.openwall.com/lists/oss-security/2013/09/01/1
CVE ID: CVE-2013-5671 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T17:15:21.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Sep/18 - http://seclists.org/oss-sec/2013/q3/528 - http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html - http://seclists.org/oss-sec/2013/q3/526 - http://www.osvdb.org/96798
CVE ID: CVE-2013-5672 State: PUBLISHED Published: 2013-09-10T19:00:00 Last Updated: 2024-08-06T17:15:21.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (
sert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/62109 - http://seclists.org/fulldisclosure/2013/Sep/5 - http://seclists.org/oss-sec/2013/q3/531 - http://secunia.com/advisories/54640 - http://www.exploit-db.com/exploits/28054 - http://packetstormsecurity.com/files/123036 - https://exch
advisories/54640 - http://www.exploit-db.com/exploits/28054 - http://packetstormsecurity.com/files/123036 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86846 - http://osvdb.org/96792 - http://archives.neohapsis.com/archives/bugtraq/2013-09/0006.html
CVE ID: CVE-2013-5673 State: PUBLISHED Published: 2013-09-10T19:00:00 Last Updated: 2024-08-06T17:22:29.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/96793 - http://seclists.org/fulldisclosure/2013/Sep/5 - http://seclists.org/oss-sec/2013/q3/531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86847 - http://www.exploit-db.com/exploits/28054 - htt
013/q3/531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/86847 - http://www.exploit-db.com/exploits/28054 - http://packetstormsecurity.com/files/123036 - http://www.securityfocus.com/bid/62108 - http://archives.neohapsis.com/archives/bugtraq/2013-09/0006.html
CVE ID: CVE-2013-5674 State: PUBLISHED Published: 2013-09-16T10:00:00Z Last Updated: 2024-09-17T03:12:46.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924 - https://moodle.org/mod/forum/discuss.php?d=238397
CVE ID: CVE-2013-5676 State: PUBLISHED Published: 2013-12-13T17:00:00 Last Updated: 2024-08-06T17:22:29.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Dec/37 - http://www.osvdb.org/100666
CVE ID: CVE-2013-5679 State: PUBLISHED Published: 2013-09-30T10:00:00Z Last Updated: 2024-09-16T22:57:08.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/62415 - http
C length. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/62415 - http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html - http://code.google.com/p/owasp-esapi-java/issues/detail?id=306 - http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf