Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-1839 State: PUBLISHED Published: 2013-09-30T20:00:00Z Last Updated: 2024-08-06T15:13:33.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/58316 - http://secunia.com/advisories/52588 - http://www.squid-cache.org/Advisories/SQUID-2013_1.txt - http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html - http://archives.neohap
/Advisories/SQUID-2013_1.txt - http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html - http://archives.neohapsis.com/archives/bugtraq/2013-03/0069.html - http://www.openwall.com/lists/oss-security/2013/03/11/7
CVE ID: CVE-2013-1840 State: PUBLISHED Published: 2013-03-22T21:00:00 Last Updated: 2024-08-06T15:13:33.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 - https://review.openstack.org/#/c/24437/ - http://www.ubuntu.com/usn/USN-1764-1 - https://review.openstack.org/#/c/24438/ - https://bug
.openstack.org/#/c/24437/ - http://www.ubuntu.com/usn/USN-1764-1 - https://review.openstack.org/#/c/24438/ - https://bugs.launchpad.net/glance/+bug/1135541 - http://secunia.com/advisories/52565 - http://rhn.redhat.com/errata/RHSA-2013-0707.html - http://osvdb.org/91304 - http://www.openwall.com/lists/oss-security/2013/03/14/15 - http://www.securityfocus.com/bid/58490 - https://review.openstack.org/#/c/24439/
CVE ID: CVE-2013-1841 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T15:13:33.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=920683 - http://www.securityfocus.com/bid/58309 - http://www.openwall.com/lists/oss-security/2013/03/04/10 - http://www.openwall.com/lists/oss-security/2013/03/12/2 - https://exchange.xforce.ibmcloud.com/vulnera
y/2013/03/04/10 - http://www.openwall.com/lists/oss-security/2013/03/12/2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/82900
CVE ID: CVE-2013-1842 State: PUBLISHED Published: 2013-03-20T15:00:00 Last Updated: 2024-08-06T15:13:33.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/03/12/3 - http://www.debian.org/security/2013/dsa-2646 - http://osvdb.org/90925 - http://lists.opensuse.org/opensuse-updates/2013-03
tp://www.debian.org/security/2013/dsa-2646 - http://osvdb.org/90925 - http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html - http://secunia.com/advisories/52638 - http://www.securityfocus.com/bid/58330 - http://secunia.com/advisories/52433 - http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/
CVE ID: CVE-2013-1843 State: PUBLISHED Published: 2013-03-20T15:00:00 Last Updated: 2024-08-06T15:13:33.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/03/12/3 - http://www.debian.org/security/2013/dsa-2646 - http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html - http://secunia.com/ad
an.org/security/2013/dsa-2646 - http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html - http://secunia.com/advisories/52638 - http://www.osvdb.org/90924 - http://www.securityfocus.com/bid/58330 - http://secunia.com/advisories/52433 - http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/
CVE ID: CVE-2013-1844 State: PUBLISHED Published: 2013-03-21T21:00:00Z Last Updated: 2024-09-17T01:51:34.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/03/12/4 - http://piwik.org/blog/2013/03/piwik-1-11/
CVE ID: CVE-2013-1845 State: PUBLISHED Published: 2013-05-02T14:00:00 Last Updated: 2024-08-06T15:13:33.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html - http://rhn.redhat.com/errata/RHSA-2013-0737.html - https://bugzilla.redhat.com/show_bug.cgi?id=929082 - http://mail-archives.apach
.redhat.com/errata/RHSA-2013-0737.html - https://bugzilla.redhat.com/show_bug.cgi?id=929082 - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3E - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E - http://www.ubuntu.com/usn/USN-1893-1 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18973 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:153 - http://subversion.apache.org/secu
oval%3Adef%3A18973 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:153 - http://subversion.apache.org/security/CVE-2013-1845-advisory.txt
CVE ID: CVE-2013-1846 State: PUBLISHED Published: 2013-05-02T14:00:00 Last Updated: 2024-08-06T15:13:33.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html - http://rhn.redhat.com/errata/RHSA-2013-0737.html - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEj
- http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3E - https://bugzilla.redhat.com/show_bug.cgi?id=929087 - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E - http://www.ubuntu.com/usn/USN-1893-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18087 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - http://subversion.apache.org/security/CVE-2013-1846-advisory.txt - http://www.mandriva.com/security/advisories?name=MDVSA-2013:153
CVE ID: CVE-2013-1847 State: PUBLISHED Published: 2013-05-02T14:00:00 Last Updated: 2024-08-06T15:13:33.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html - http://rhn.redhat.com/errata/RHSA-2013-0737.html - https://bugzilla.redhat.com/show_bug.cgi?id=929090 - http://mail-archives.apache.org/mod_mbox/subversion
013-0737.html - https://bugzilla.redhat.com/show_bug.cgi?id=929090 - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3E - http://subversion.apache.org/security/CVE-2013-1847-advisory.txt - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E - http://www.ubuntu.com/usn/USN-1893-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18538 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - http://www.mandriva.com/security/advisories?name=MDVSA-20
://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:153
CVE ID: CVE-2013-1848 State: PUBLISHED Published: 2013-03-22T10:00:00 Last Updated: 2024-08-06T15:13:33.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/8d0c2d10dd72c5292eda7a06231056a4c972e4cc - http://www.ubuntu.com/usn/USN-1812-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://rhn.redhat.com/errat
buntu.com/usn/USN-1812-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://rhn.redhat.com/errata/RHSA-2013-1051.html - http://rhn.redhat.com/errata/RHSA-2013-0928.html - http://www.ubuntu.com/usn/USN-1809-1 - http://www.ubuntu.com/usn/USN-1814-1 - http://www.openwall.com/lists/oss-security/2013/03/20/8 - http://www.ubuntu.com/usn/USN-1813-1 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d0c2d10dd72c5292eda7a06231056a4c972e4cc - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4 - https://bugzilla.redhat.com/show_bug.cgi?id=920783 - http://rhn.redh
.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4 - https://bugzilla.redhat.com/show_bug.cgi?id=920783 - http://rhn.redhat.com/errata/RHSA-2013-1026.html - http://www.ubuntu.com/usn/USN-1811-1
CVE ID: CVE-2013-1849 State: PUBLISHED Published: 2013-05-02T14:00:00 Last Updated: 2024-08-06T15:13:33.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2013/Mar/56 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18980 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html - http://rhn.redhat.co
3Aorg.mitre.oval%3Adef%3A18980 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html - http://rhn.redhat.com/errata/RHSA-2013-0737.html - https://bugzilla.redhat.com/show_bug.cgi?id=929093 - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3E - http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E - http://subversion.apache.org/security/CVE-2013-1849-advisory.txt - http://www.ubuntu.com/usn/USN-1893-1 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - http://www.mandri
p://www.ubuntu.com/usn/USN-1893-1 - http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:153
CVE ID: CVE-2013-1850 State: PUBLISHED Published: 2014-03-14T16:00:00 Last Updated: 2024-08-06T15:13:33.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-009/
CVE ID: CVE-2013-1851 State: PUBLISHED Published: 2014-03-14T16:00:00 Last Updated: 2024-08-06T15:13:33.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2013-010/
CVE ID: CVE-2013-1852 State: PUBLISHED Published: 2014-02-05T15:00:00 Last Updated: 2024-08-06T15:13:33.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/24789 - http://packetstormsecurity.com/files/120817/WordPress-LeagueManager-3.8-SQL-Injection.html - http://wordpress.org/plugins/leaguemanager/changelog - http://osvdb.org/91442
CVE ID: CVE-2013-1853 State: PUBLISHED Published: 2014-01-24T18:00:00 Last Updated: 2024-08-06T15:13:33.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702905 - https://bugzilla.redhat.com/show_bug.cgi?id=920848 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00080.html - http://www.openwall.com/lists/oss-security/2013/03/13/1 - https://bugzilla.gnome.org/show_bug.cgi?id=695117
CVE ID: CVE-2013-1854 State: PUBLISHED Published: 2013-03-19T22:00:00 Last Updated: 2024-08-06T15:20:36.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2013-04/msg00078.html - http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00
s.apple.com/archives/security-announce/2013/Oct/msg00006.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00071.html - http://support.apple.com/kb/HT5784 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00075.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00079.html - https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2013-0699.html - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-
utput=gplain - http://rhn.redhat.com/errata/RHSA-2013-0699.html - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
CVE ID: CVE-2013-1855 State: PUBLISHED Published: 2013-03-19T22:00:00 Last Updated: 2024-08-06T15:20:35.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2013/Oct/msg00006
nalyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html - https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain - http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html - http://support.apple.com/kb/HT5784 - http://rhn.redhat.com/errata/RHSA-2013-0698.html - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-
sg00072.html - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
CVE ID: CVE-2013-1856 State: PUBLISHED Published: 2013-03-19T22:00:00 Last Updated: 2024-08-06T15:20:35.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program
D or (2) an external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html - http://support.apple.com/kb/HT5784 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - https://groups.google.com/group/rubyonrails-security/msg/6c2482d4ed1545e6?dmode=source&output=gplain - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
CVE ID: CVE-2013-1857 State: PUBLISHED Published: 2013-03-19T22:00:00 Last Updated: 2024-08-06T15:20:35.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-
3a; sequence. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html - http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html - http://support.apple.com/kb/HT5784 - http://rhn.redhat.com/errata/RHSA-2013-0698.html - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html - https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://weblog.rubyonrails.or
17a5943f6d6?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2014-1863.html - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
CVE ID: CVE-2013-1858 State: PUBLISHED Published: 2013-04-05T21:00:00Z Last Updated: 2024-08-06T15:20:35.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e66eded8309ebf679d3d3c1f5820d1f2ca332c71 - http://www.openwall.com/lists/oss-secur
torvalds/linux-2.6.git%3Ba=commit%3Bh=e66eded8309ebf679d3d3c1f5820d1f2ca332c71 - http://www.openwall.com/lists/oss-security/2013/03/14/6 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3 - http://stealth.openwall.net/xSports/clown-newuser.c - https://github.com/torvalds/linux/commit/e66eded8309ebf679d3d3c1f5820d1f2ca332c71 - https://bugzilla.redhat.com/show_bug.cgi?id=921448
CVE ID: CVE-2013-1859 State: PUBLISHED Published: 2013-03-27T21:00:00Z Last Updated: 2024-09-17T03:27:47.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the configuration options, which allows remote attackers to read and edit configuration options via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/91257 - http://drupal.org/node/1942330 - http://packetstormsecurity.com/files/120788/Drupal-Node-Parameter-Control-6.x-Access-Bypass.html - http://www.openwall.com/lists/oss-security/2013/03/15/2 - http://seclists.org/fulldisclosure/2013/
-Access-Bypass.html - http://www.openwall.com/lists/oss-security/2013/03/15/2 - http://seclists.org/fulldisclosure/2013/Mar/133
CVE ID: CVE-2013-1860 State: PUBLISHED Published: 2013-03-22T10:00:00 Last Updated: 2024-08-06T15:20:36.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/c0f5ecee4e741667b2493c742b60b6218d40b3aa - https://bugzilla.redhat.com/show_bug.cgi?id=921970 - http://www.ubuntu.com/usn/USN-1812-1 - http://git.kernel