deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1653
Published: 2013-03-20
Description: Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.
CVSS Score: 7.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://secunia.com/advisories/52596
CVE: CVE-2013-1654
Published: 2013-03-20
Description: Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html
CVE: CVE-2013-1655
Published: 2013-03-20
Description: Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://secunia.com/advisories/52596
CVE: CVE-2013-2274
Published: 2013-03-20
Description: Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html
CVE: CVE-2013-2275
Published: 2013-03-20
Description: The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html
CVE: CVE-2013-0711
Published: 2013-03-20
Description: IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01; http://jvn.jp/en/jp/JVN45545972/995359/index.html; http://jvn.jp/en/jp/JVN45545972/index.html
CVE: CVE-2013-0712
Published: 2013-03-20
Description: IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN01611135/995359/index.html; http://jvn.jp/en/jp/JVN01611135/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000019
CVE: CVE-2013-0713
Published: 2013-03-20
Description: IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01; http://jvn.jp/en/jp/JVN52492830/995359/index.html; http://jvn.jp/en/jp/JVN52492830/index.html
CVE: CVE-2013-0714
Published: 2013-03-20
Description: IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01; http://jvn.jp/en/jp/JVN20671901/995359/index.html; http://jvn.jp/en/jp/JVN20671901/index.html
CVE: CVE-2013-0715
Published: 2013-03-20
Description: The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01; http://jvn.jp/en/jp/JVN65923092/995359/index.html; http://jvn.jp/en/jp/JVN65923092/index.html
CVE: CVE-2013-0716
Published: 2013-03-20
Description: The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01; http://jvn.jp/en/jp/JVN41022517/995359/index.html; http://jvn.jp/en/jp/JVN41022517/index.html
CVE: CVE-2013-1750
Published: 2013-03-20
Description: Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a malformed MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/03152013_player/en/; http://service.real.com/realplayer/security/03152013_player/en/
CVE: CVE-2013-1876
Published: 2013-03-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2615.  Reason: This candidate is a duplicate of CVE-2013-2615.  Notes: All CVE users should reference CVE-2013-2615 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1877
Published: 2013-03-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2616.  Reason: This candidate is a duplicate of CVE-2013-2616.  Notes: All CVE users should reference CVE-2013-2616 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1878
Published: 2013-03-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2617.  Reason: This candidate is a duplicate of CVE-2013-2617.  Notes: All CVE users should reference CVE-2013-2617 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1875
Published: 2013-03-20
Description: command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/120847/Ruby-Gem-Command-Wrap-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Mar/175; http://www.openwall.com/lists/oss-security/2013/03/19/9
CVE: CVE-2013-2615
Published: 2013-03-20
Description: lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/120776/Ruby-Gem-Fastreader-1.0.8-Command-Execution.html; http://packetstormsecurity.com/files/120845/Ruby-Gem-Fastreader-1.0.8-Code-Execution.html; http://seclists.org/fulldisclosure/2013/Mar/122
CVE: CVE-2013-2616
Published: 2013-03-20
Description: lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/120777/Ruby-Gem-Minimagic-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Mar/123; http://www.openwall.com/lists/oss-security/2013/03/19/9
CVE: CVE-2013-2617
Published: 2013-03-20
Description: lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/120778/Ruby-Gem-Curl-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Mar/124; http://www.openwall.com/lists/oss-security/2013/03/19/9
CVE: CVE-2011-4515
Published: 2013-03-21
Description: Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging (1) physical access or (2) Sm@rt Server access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0665
Published: 2013-03-21
Description: Schweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-01.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-01.pdf
CVE: CVE-2013-0667
Published: 2013-03-21
Description: Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0668
Published: 2013-03-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0669
Published: 2013-03-21
Description: The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0670
Published: 2013-03-21
Description: CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0671
Published: 2013-03-21
Description: Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0672
Published: 2013-03-21
Description: Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf
CVE: CVE-2013-0674
Published: 2013-03-21
Description: Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0675
Published: 2013-03-21
Description: Buffer overflow in CCEServer (aka the central communications component) in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0676
Published: 2013-03-21
Description: Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0677
Published: 2013-03-21
Description: The web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to obtain sensitive information or cause a denial of service via a crafted project file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0678
Published: 2013-03-21
Description: Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0679
Published: 2013-03-21
Description: Directory traversal vulnerability in the web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote authenticated users to read arbitrary files via vectors involving a query for a pathname.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf
CVE: CVE-2013-0287
Published: 2013-03-21
Description: The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938; http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb; http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4
CVE: CVE-2013-1051
Published: 2013-03-21
Description: apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/91428; http://secunia.com/advisories/52633; http://www.ubuntu.com/usn/USN-1762-1
CVE: CVE-2013-1052
Published: 2013-03-21
Description: pam-xdg-support, as used in Ubuntu 12.10, does not properly handle the PATH environment variable, which allows local users to gain privileges via unspecified vectors related to sudo.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/58550; http://www.ubuntu.com/usn/USN-1766-1; https://exchange.xforce.ibmcloud.com/vulnerabilities/82918
CVE: CVE-2013-1427
Published: 2013-03-21
Description: The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://osvdb.org/91462; http://www.debian.org/security/2013/dsa-2649; http://www.securityfocus.com/bid/58528
CVE: CVE-2013-2279
Published: 2013-03-21
Description: CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0118.html; http://secunia.com/advisories/52610; http://www.securityfocus.com/bid/58609
CVE: CVE-2012-5757
Published: 2013-03-21
Description: Cross-site scripting (XSS) vulnerability in the Web Client in IBM Rational ClearQuest 7.1.x before 7.1.2.10 and 8.x before 8.0.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM77153; http://www.ibm.com/support/docview.wss?uid=swg21619993; https://exchange.xforce.ibmcloud.com/vulnerabilities/80061
CVE: CVE-2013-0126
Published: 2013-03-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2013/03/verizon-fios-router-csrf-cve-2013-0126.html; http://www.exploit-db.com/exploits/24860/; http://www.kb.cert.org/vuls/id/278204
CVE: CVE-2013-0453
Published: 2013-03-21
Description: Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV37766; http://www.ibm.com/support/docview.wss?uid=swg21631351; https://exchange.xforce.ibmcloud.com/vulnerabilities/80969
CVE: CVE-2013-0123
Published: 2013-03-21
Description: Multiple SQL injection vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to execute arbitrary SQL commands via (1) the nHistoryId parameter to WebProd/pages/pgHistory.asp or (2) the OrderBy parameter to WebProd/pages/pgadmin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/406596; http://www.kb.cert.org/vuls/id/406596
CVE: CVE-2013-0124
Published: 2013-03-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the (1) Number or (2) UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/406596; http://www.kb.cert.org/vuls/id/406596
CVE: CVE-2013-1844
Published: 2013-03-21
Description: Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://piwik.org/blog/2013/03/piwik-1-11/; http://www.openwall.com/lists/oss-security/2013/03/12/4; http://piwik.org/blog/2013/03/piwik-1-11/
CVE: CVE-2013-2632
Published: 2013-03-21
Description: Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by the Bejeweled game.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/v8/source/browse/trunk/ChangeLog; http://googlechromereleases.blogspot.com/2013/03/dev-channel-update_18.html; https://code.google.com/p/chromium/issues/detail?id=194749
CVE: CVE-2013-2633
Published: 2013-03-21
Description: Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://piwik.org/blog/2013/03/piwik-1-11/; http://piwik.org/blog/2013/03/piwik-1-11/
CVE: CVE-2013-0914
Published: 2013-03-22
Description: The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ca39528c01a933f6689cd6505ce65bd6d68a530; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
CVE: CVE-2013-1792
Published: 2013-03-22
Description: Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0da9dfdd2cd9889201bc6f6f43580c99165cd087; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
CVE: CVE-2013-1796
Published: 2013-03-22
Description: The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c300aa64ddf57d9c5d9c898a64b36877345dd4a9; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html