Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
w.pidgin.im/news/security/?id=67 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18340 - http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html
CVE ID: CVE-2013-0274 State: PUBLISHED Published: 2013-02-16T21:00:00 Last Updated: 2024-08-06T14:18:09.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html - http://www.pidgin.im/news/security/?id=68 - http://www.ubuntu.com/usn/USN-1746-1 - http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3 - http://lists.opensuse.org/open
http://www.ubuntu.com/usn/USN-1746-1 - http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3 - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18221
CVE ID: CVE-2013-0275 State: PUBLISHED Published: 2013-03-12T16:00:00Z Last Updated: 2024-08-06T14:18:09.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/58204 - https://bugzilla.redhat.com/show_bug.cgi?id=892823 - http://ganglia.info/?p=566 - http://www.openwall.com/lists/oss-security/2013/02/08/6 - https://github.com/ganglia/ganglia-web/commit/31d348947419058c43b8dfcd062e2988abd5058e
CVE ID: CVE-2013-0276 State: PUBLISHED Published: 2013-02-13T01:00:00 Last Updated: 2024-08-06T14:18:09.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/57896 - http://secunia.com/advisories/52774 - http://support.apple.com/kb/HT5784 - http://www.debian.org/security/2013/dsa-2620 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http
/www.debian.org/security/2013/dsa-2620 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://www.openwall.com/lists/oss-security/2013/02/11/5 - http://rhn.redhat.com/errata/RHSA-2013-0686.html - http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html - http://www.osvdb.org/90072 - http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ - http://secunia.com/advisories/52112 - https://groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain
CVE ID: CVE-2013-0277 State: PUBLISHED Published: 2013-02-13T01:00:00 Last Updated: 2024-08-06T14:18:09.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1028109 - https://puppet.com/security/cve/cve-2013-0277 - http://support.apple.com/kb/HT5784 - http://www.debian.org/security/2013/dsa-2620 - http://lists.apple.com/archives/security-announce/20
pple.com/kb/HT5784 - http://www.debian.org/security/2013/dsa-2620 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://www.osvdb.org/90073 - https://groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837?dmode=source&output=gplain - http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html - http://www.openwall.com/lists/oss-security/2013/02/11/6 - http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ - http://secunia.com/advisories/52112
CVE ID: CVE-2013-0278 State: REJECTED Published: 2013-04-03T00:00:00Z Last Updated: 2024-09-16T23:00:54.967Z Description: No description available.
CVE ID: CVE-2013-0279 State: REJECTED Published: 2013-04-03T00:00:00Z Last Updated: 2024-09-16T23:31:38.394Z Description: No description available.
CVE ID: CVE-2013-0280 State: REJECTED Published: 2013-04-03T00:00:00Z Last Updated: 2024-09-16T17:04:16.400Z Description: No description available.
CVE ID: CVE-2013-0281 State: PUBLISHED Published: 2013-11-23T11:00:00 Last Updated: 2024-08-06T14:18:09.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking). Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1635.html - https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93 - https://bugzilla.redhat.com/show_bug.cgi?id=891922
CVE ID: CVE-2013-0282 State: PUBLISHED Published: 2013-04-12T22:00:00Z Last Updated: 2024-08-06T14:18:09.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/keystone/+bug/1121494 - https://review.openstack.org/#/c/22321/ - http://www.openwall.com/lists/oss-security/2013/02/19/3 - https://launchpad.net/keystone/grizzly/2013.1 -
g/#/c/22321/ - http://www.openwall.com/lists/oss-security/2013/02/19/3 - https://launchpad.net/keystone/grizzly/2013.1 - https://launchpad.net/keystone/+milestone/2012.2.4 - https://review.openstack.org/#/c/22319/ - https://review.openstack.org/#/c/22320/
CVE ID: CVE-2013-0283 State: PUBLISHED Published: 2019-12-05T16:02:14 Last Updated: 2024-08-06T14:18:09.781Z Vendors: Katello Products: Katello Problem Types: Username in Notification page XSS Description: Katello: Username in Notification page has cross site scripting Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0283 - https://access.redhat.com/security/cve/cve-2013-0283
CVE ID: CVE-2013-0284 State: PUBLISHED Published: 2013-04-09T20:00:00Z Last Updated: 2024-09-17T02:16:38.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q1/304 - https://newrelic.com/docs/ruby/ruby-agent-security-notification
CVE ID: CVE-2013-0285 State: PUBLISHED Published: 2013-04-09T20:00:00Z Last Updated: 2024-09-16T18:54:26.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156. Additional Analyst Notes: - CVE Program Container: References: - ht
onversion, a similar vulnerability to CVE-2013-0156. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q1/304 - https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
CVE ID: CVE-2013-0286 State: PUBLISHED Published: 2020-01-27T14:22:18 Last Updated: 2024-08-06T14:18:09.521Z Vendors: Pinboard theme authors Products: Pinboard theme Problem Types: XSS Description: Pinboard 1.0.6 theme for Wordpress has XSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/02/14/4
CVE ID: CVE-2013-0287 State: PUBLISHED Published: 2013-03-21T16:00:00 Last Updated: 2024-08-06T14:18:09.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-03/msg00115.html - http://secunia.com/advisories/52704 - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a
cunia.com/advisories/52704 - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5 - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4 - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938 - https://lists.fedorahosted.org/pipermail/sssd-devel/2013-March/014066.html - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb - http://www.securityfocus.com/bid/58593 - http://secunia.com/advisories/52722 - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad7
id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1 - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93 - http://securitytracker.com/id?1028317 - http://rhn.redhat.com/errata/RHSA-2013-0663.html - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b - http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb
CVE ID: CVE-2013-0288 State: PUBLISHED Published: 2013-03-04T21:00:00 Last Updated: 2024-08-06T14:18:09.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288 - http://rhn.redhat.com/errata/RHSA-2013-0590.html - h
nces: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288 - http://rhn.redhat.com/errata/RHSA-2013-0590.html - http://www.securityfocus.com/bid/58007 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319 - http://www.debian.org/security/2012/dsa-2628 - http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81 - http://www.openwall.com/lists/oss-security/2013/02/18/2 - http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html - http://secunia.com/advisories/52212 - http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b - http://secunia.com/advisories/52242 - http://arthurdejong.org
dapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b - http://secunia.com/advisories/52242 - http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:106 - http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/82175 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071 - http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html - http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html
CVE ID: CVE-2013-0289 State: PUBLISHED Published: 2014-05-23T14:00:00 Last Updated: 2024-08-06T14:18:09.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html - http://www.securityfocus.com/bid/57423 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82232 - http://www.op
ml - http://www.securityfocus.com/bid/57423 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82232 - http://www.openwall.com/lists/oss-security/2013/02/20/9 - http://secunia.com/advisories/55190 - http://sourceforge.net/projects/isync/files/isync/1.0.6/ - http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb - http://security.gentoo.org/glsa/glsa-201310-02.xml - http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html
CVE ID: CVE-2013-0290 State: PUBLISHED Published: 2013-02-19T19:00:00 Last Updated: 2024-08-06T14:18:09.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - https://bugzilla.redhat.com/show_bug.cgi?id=911473 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=77
a.redhat.com/show_bug.cgi?id=911473 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=77c1090f94d1b0b5186fb13a1b71b47b1343f87f - https://github.com/torvalds/linux/commit/77c1090f94d1b0b5186fb13a1b71b47b1343f87f - http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.8.bz2 - http://www.openwall.com/lists/oss-security/2013/02/15/2 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00009.html
CVE ID: CVE-2013-0291 State: PUBLISHED Published: 2020-01-30T13:00:16 Last Updated: 2024-08-06T14:18:09.783Z Vendors: NextGEN Gallery Plugin authors Products: NextGEN Gallery Plugin Problem Types: Path Disclosure Description: NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/57957 - http://www.openwall.com/lists/oss-security/2013/02/15/3
CVE ID: CVE-2013-0292 State: PUBLISHED Published: 2013-03-04T21:00:00 Last Updated: 2024-08-06T14:18:09.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.exploit-db.com/exploits/33614 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:071 - http://secunia.com/advisories/52225 - https://exchange.xfor
//www.mandriva.com/security/advisories?name=MDVSA-2013:071 - http://secunia.com/advisories/52225 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82135 - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658 - http://secunia.com/advisories/52375 - http://www.ubuntu.com/usn/USN-1753-1 - http://rhn.redhat.com/errata/RHSA-2013-0568.html - http://www.securityfocus.com/bid/57985 - http://secunia.com/advisories/52404 - http://www.openwall.com/lists/oss-security/2013/02/15/10 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://osvdb.org/90302 - http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca - https://bugs.freedesktop.
tp://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca - https://bugs.freedesktop.org/show_bug.cgi?id=60916
CVE ID: CVE-2013-0293 State: PUBLISHED Published: 2019-12-10T13:14:17 Last Updated: 2024-08-06T14:18:09.873Z Vendors: oVirt Node Products: oVirt Node Problem Types: screen accepts F2 to drop to shell Description: oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2013-0293 - https://access.redhat.com/security/cve/cve-2013-0293 - http://www.openwall.com/lists/oss-security/2013/02/28/13 - http://www.securityfocus.com/bid/58227 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82474
CVE ID: CVE-2013-0294 State: PUBLISHED Published: 2020-01-28T15:53:24 Last Updated: 2024-08-06T14:18:09.615Z Vendors: pyrad Products: pyrad Problem Types: Cryptography Description: packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=911682 - https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5 - http://www.securityfocus.com/bid/57984 - http://www.openwall.com/lists/oss-security/2013/02/15/13 - https://
f4953bee5 - http://www.securityfocus.com/bid/57984 - http://www.openwall.com/lists/oss-security/2013/02/15/13 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82133 - http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html
CVE ID: CVE-2013-0295 State: REJECTED Published: 2020-02-13T19:53:52 Last Updated: 2020-02-13T19:53:52 Description: No description available.
CVE ID: CVE-2013-0296 State: PUBLISHED Published: 2014-04-27T21:00:00 Last Updated: 2024-08-06T14:18:09.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html - http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html - http://www.openwall.com/lists/oss-security/201
://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html - http://www.openwall.com/lists/oss-security/2013/02/16/3 - http://www.openwall.com/lists/oss-security/2013/02/15/4 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608
CVE ID: CVE-2013-0297 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T14:18:09.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-003/
CVE ID: CVE-2013-0298 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T14:18:09.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-003/
CVE ID: CVE-2013-0299 State: PUBLISHED Published: 2014-03-14T17:00:00 Last Updated: 2024-08-06T14:18:09.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/sett
/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-004/
CVE ID: CVE-2013-0300 State: PUBLISHED Published: 2014-03-14T17:00:00 Last Updated: 2024-08-06T14:18:09.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php. Additional
/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-004/
CVE ID: CVE-2013-0301 State: PUBLISHED Published: 2014-03-14T17:00:00 Last Updated: 2024-08-06T14:18:09.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-004/