deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6367
Published: 2013-12-14
Description: The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b963a22e6d1a266a67e9eecc88134713fd54775c; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
CVE: CVE-2013-6368
Published: 2013-12-14
Description: The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fd; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
CVE: CVE-2013-6376
Published: 2013-12-14
Description: The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=17d68b763f09a9ce824ae23eb62c9efc57b69271; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
CVE: CVE-2013-4520
Published: 2013-12-14
Description: xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, which causes a structure to be accessed as a different type.  NOTE: this issue is due to an incomplete fix for CVE-2012-2825.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/oss-sec/2013/q4/238; http://seclists.org/oss-sec/2013/q4/239; http://secunia.com/advisories/56072
CVE: CVE-2013-6271
Published: 2013-12-14
Description: Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2013/Nov/204; http://www.securitytracker.com/id/1029410; http://www.theregister.co.uk/2013/12/10/android_has_lockbypass_bug/
CVE: CVE-2013-7105
Published: 2013-12-14
Description: Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1, and 10.0.0; and Interstage Studio 9.0.0, 9.1.0, 9.2.0, and 10.0.0, has unspecified impact and attack vectors related to "ihsrlog/rotatelogs."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.fujitsu.com/global/support/software/security/products-f/interstage-201302e.html; http://www.securityfocus.com/bid/63929; http://www.securitytracker.com/id/1029398
CVE: CVE-2013-3042
Published: 2013-12-14
Description: Directory traversal vulnerability in the server in IBM Rational Software Architect Design Manager and Rhapsody Design Manager 3.x and 4.x before 4.0.5 allows local users to read arbitrary files via vectors involving temporary files.
CVSS Score: 2.1 (LOW)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655724; https://exchange.xforce.ibmcloud.com/vulnerabilities/84768; http://www-01.ibm.com/support/docview.wss?uid=swg21655724
CVE: CVE-2013-3043
Published: 2013-12-14
Description: Directory traversal vulnerability in the client in IBM Rational Software Architect Design Manager and Rhapsody Design Manager 3.x and 4.x before 4.0.5 allows local users to read arbitrary files via vectors involving temporary files.
CVSS Score: 2.1 (LOW)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655724; https://exchange.xforce.ibmcloud.com/vulnerabilities/84769; http://www-01.ibm.com/support/docview.wss?uid=swg21655724
CVE: CVE-2013-4000
Published: 2013-12-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) start or (2) stop services.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657932; https://exchange.xforce.ibmcloud.com/vulnerabilities/85150; http://www-01.ibm.com/support/docview.wss?uid=swg21657932
CVE: CVE-2013-4001
Published: 2013-12-14
Description: Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657932; https://exchange.xforce.ibmcloud.com/vulnerabilities/85151; http://www-01.ibm.com/support/docview.wss?uid=swg21657932
CVE: CVE-2013-4845
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability on HP Officejet Pro 8500 (aka A909) All-in-One printers allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04035829; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04035829
CVE: CVE-2013-5438
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability in the web server in IBM Flex System Manager (FSM) 1.1.0 through 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_flex_system_manager_web_server_allows_generic_xss_cve_2013_5438; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5094212; https://exchange.xforce.ibmcloud.com/vulnerabilities/87753
CVE: CVE-2013-6709
Published: 2013-12-14
Description: The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul57111.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709; http://tools.cisco.com/security/center/viewAlert.x?alertId=32153; http://www.securitytracker.com/id/1029492
CVE: CVE-2013-6710
Published: 2013-12-14
Description: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Training Center allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCul25567.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6710; http://tools.cisco.com/security/center/viewAlert.x?alertId=32154; http://www.securitytracker.com/id/1029492
CVE: CVE-2013-6711
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability in the product-creation administrative page in Cisco WebEx Sales Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul25540.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6711; http://tools.cisco.com/security/center/viewAlert.x?alertId=32156; http://www.securitytracker.com/id/1029493
CVE: CVE-2013-6959
Published: 2013-12-14
Description: Open redirect vulnerability in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul25557.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/100901; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6959; http://tools.cisco.com/security/center/viewAlert.x?alertId=32155
CVE: CVE-2013-6960
Published: 2013-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meeting Center allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36248.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100904; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6960; http://tools.cisco.com/security/center/viewAlert.x?alertId=32152
CVE: CVE-2013-6961
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability in the Collaboration Partner Access Console (CPAC) in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36237.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100905; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6961; http://www.securityfocus.com/bid/64288
CVE: CVE-2013-6962
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability in the mobile-browser subsystem in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36228.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100906; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6962; http://www.securityfocus.com/bid/64275
CVE: CVE-2013-6963
Published: 2013-12-14
Description: Cross-site scripting (XSS) vulnerability in the registration component in Cisco WebEx Training Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36207.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100907; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6963; http://www.securityfocus.com/bid/64277
CVE: CVE-2013-6964
Published: 2013-12-14
Description: Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via unspecified vectors, aka Bug ID CSCul36197.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://osvdb.org/100908; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6964; http://tools.cisco.com/security/center/viewAlert.x?alertId=32158
CVE: CVE-2013-6965
Published: 2013-12-14
Description: The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul36183.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/100911; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6965; http://tools.cisco.com/security/center/viewAlert.x?alertId=32157
CVE: CVE-2013-6967
Published: 2013-12-14
Description: Open redirect vulnerability in the mobile-browser subsystem in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36020.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/100912; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6967; http://www.securitytracker.com/id/1029493
CVE: CVE-2013-6968
Published: 2013-12-14
Description: Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, which allows remote attackers to enumerate attendees via a series of requests, aka Bug ID CSCul36003.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/100913; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6968; http://tools.cisco.com/security/center/viewAlert.x?alertId=32147
CVE: CVE-2013-6969
Published: 2013-12-14
Description: The training-registration page in Cisco WebEx Training Center allows remote attackers to modify unspecified fields via unknown vectors, aka Bug ID CSCul35990.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101003; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6969; http://www.securityfocus.com/bid/64305
CVE: CVE-2013-6970
Published: 2013-12-14
Description: Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/101002; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6970; http://www.securityfocus.com/bid/64306
CVE: CVE-2013-6971
Published: 2013-12-14
Description: Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul57140.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/100910; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6971; http://tools.cisco.com/security/center/viewAlert.x?alertId=32146
CVE: CVE-2013-6972
Published: 2013-12-14
Description: Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/100914; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6972; http://tools.cisco.com/security/center/viewAlert.x?alertId=32145
CVE: CVE-2013-6973
Published: 2013-12-14
Description: Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/100915; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6973; http://tools.cisco.com/security/center/viewAlert.x?alertId=32144
CVE: CVE-2013-3140
Published: 2013-12-16
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted CMarkup object, aka "Internet Explorer Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; http://www.zerodayinitiative.com/advisories/ZDI-13-084/; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037
CVE: CVE-2013-6191
Published: 2013-12-17
Description: Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1029496; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04041093; http://www.securitytracker.com/id/1029496
CVE: CVE-2013-6192
Published: 2013-12-17
Description: Cross-site request forgery (CSRF) vulnerability in HP Operations Orchestration before 9 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securitytracker.com/id/1029496; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04041093; http://www.securitytracker.com/id/1029496
CVE: CVE-2013-6420
Published: 2013-12-17
Description: The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415; http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
CVE: CVE-2013-6925
Published: 2013-12-17
Description: The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value.
CVSS Score: 8.3 (HIGH)
CWE: CWE-330
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-340-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-324789.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-13-340-01
CVE: CVE-2013-6926
Published: 2013-12-17
Description: The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on administrative actions by leveraging access to a (1) guest or (2) operator account.
CVSS Score: 8.0 (HIGH)
CWE: CWE-863
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-340-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-324789.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-13-340-01
CVE: CVE-2013-6966
Published: 2013-12-17
Description: Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36031.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/100909; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6966; http://tools.cisco.com/security/center/viewAlert.x?alertId=32149
CVE: CVE-2013-2813
Published: 2013-12-17
Description: The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 gateways allows remote attackers to cause a denial of service (reboot or link outage) via a crafted DNP3 TCP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-346-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-346-01
CVE: CVE-2013-2814
Published: 2013-12-17
Description: Cooper Power Systems Cybectec DNP3 Master OPC Server allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-346-02; http://ics-cert.us-cert.gov/advisories/ICSA-13-346-02
CVE: CVE-2013-2816
Published: 2013-12-17
Description: The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 gateways allows physically proximate attackers to cause a denial of service (reboot or link outage) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-346-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-346-01
CVE: CVE-2013-6038
Published: 2013-12-17
Description: Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/100988; http://www.kb.cert.org/vuls/id/586958; http://osvdb.org/100988
CVE: CVE-2013-6193
Published: 2013-12-17
Description: Unspecified vulnerability on HP LaserJet M1522n and M2727; LaserJet Pro 100, 300, 400, CM1415fnw, CP1*, M121*, M1536dnf, and P1*; Color LaserJet CM* and CP*; and TopShot LaserJet Pro M275 printers allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/882676; http://www.securitytracker.com/id/1029497; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04041432
CVE: CVE-2013-6327
Published: 2013-12-17
Description: Cross-site scripting (XSS) vulnerability in the HTTP Option in IBM Sterling Connect:Enterprise 1.3 before 1.3.0.2 iFix 1 and 1.4 before 1.4.0.0 iFix 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross-frame scripting" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21659907; https://exchange.xforce.ibmcloud.com/vulnerabilities/88908; http://www-01.ibm.com/support/docview.wss?uid=swg21659907
CVE: CVE-2013-6329
Published: 2013-12-17
Description: IBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of service via a crafted handshake during resumption of an SSLv2 session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/56058; http://www-01.ibm.com/support/docview.wss?uid=swg21659548; http://www-01.ibm.com/support/docview.wss?uid=swg21659716
CVE: CVE-2013-6721
Published: 2013-12-17
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.x through 8.0.0.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving widgets.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/56130; http://www-01.ibm.com/support/docview.wss?uid=swg1IV51765; http://www-01.ibm.com/support/docview.wss?uid=swg21659623
CVE: CVE-2013-6733
Published: 2013-12-17
Description: Cross-site scripting (XSS) vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21659419; https://exchange.xforce.ibmcloud.com/vulnerabilities/89396; http://www-01.ibm.com/support/docview.wss?uid=swg21659419
CVE: CVE-2013-7127
Published: 2013-12-17
Description: Apple Safari 6.0.5 on Mac OS X 10.7.5 and 10.8.5 stores cleartext credentials in LastSession.plist, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.securelist.com/en/blog/8168/Loophole_in_Safari; https://exchange.xforce.ibmcloud.com/vulnerabilities/89941; http://www.securelist.com/en/blog/8168/Loophole_in_Safari
CVE: CVE-2013-7128
Published: 2013-12-17
Description: Valve Bug Reporter in the valve-bugreporter package 2.10+bsos1 in Valve SteamOS Beta stores cleartext credentials in a .valve-bugreporter.cfg file upon a Remember Credentials action, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: https://github.com/ValveSoftware/SteamOS/issues/19; https://github.com/ValveSoftware/SteamOS/issues/19
CVE: CVE-2013-6882
Published: 2013-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject arbitrary web script or HTML via unspecified form fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100996; http://osvdb.org/101000; http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html
CVE: CVE-2013-6883
Published: 2013-12-17
Description: Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/100999; http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Dec/80