deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2132
Published: 2013-08-15
Description: bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597; http://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html; http://seclists.org/oss-sec/2013/q2/447
CVE: CVE-2013-5300
Published: 2013-08-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forums.alienvault.com/discussion/1609/patch-release-4-3-1; http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html; http://secunia.com/advisories/54264
CVE: CVE-2013-0585
Published: 2013-08-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management user interfaces.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21646136; https://exchange.xforce.ibmcloud.com/vulnerabilities/83356; http://www-01.ibm.com/support/docview.wss?uid=swg21646136
CVE: CVE-2013-0587
Published: 2013-08-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM90118; http://www-01.ibm.com/support/docview.wss?uid=swg21646618; https://exchange.xforce.ibmcloud.com/vulnerabilities/84345
CVE: CVE-2013-3034
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the web console.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21646136; http://www.securityfocus.com/bid/61757; https://exchange.xforce.ibmcloud.com/vulnerabilities/84646
CVE: CVE-2013-3040
Published: 2013-08-16
Description: IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21646136; http://www.securityfocus.com/bid/61755; https://exchange.xforce.ibmcloud.com/vulnerabilities/84765
CVE: CVE-2013-4007
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter systems allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093491; https://exchange.xforce.ibmcloud.com/vulnerabilities/85274; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093491
CVE: CVE-2013-4698
Published: 2013-08-16
Description: Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://cs.cybozu.co.jp/information/20130812up02.php; http://jvn.jp/en/jp/JVN21103639/374951/index.html; http://jvn.jp/en/jp/JVN21103639/index.html
CVE: CVE-2013-5095
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kb.juniper.net/JSA10585; http://www.securitytracker.com/id/1028923; http://kb.juniper.net/JSA10585
CVE: CVE-2013-5096
Published: 2013-08-16
Description: Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/JSA10585; http://www.securityfocus.com/bid/61794; http://www.securitytracker.com/id/1028923
CVE: CVE-2013-5097
Published: 2013-08-16
Description: Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, aka PR 879462.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/JSA10585; http://www.securitytracker.com/id/1028923; http://kb.juniper.net/JSA10585
CVE: CVE-2013-4128
Published: 2013-08-16
Description: Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/96217; http://rhn.redhat.com/errata/RHSA-2013-1151.html; http://rhn.redhat.com/errata/RHSA-2013-1152.html
CVE: CVE-2013-4213
Published: 2013-08-16
Description: Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: http://osvdb.org/96216; http://rhn.redhat.com/errata/RHSA-2013-1151.html; http://rhn.redhat.com/errata/RHSA-2013-1152.html
CVE: CVE-2013-3319
Published: 2013-08-16
Description: The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://labs.integrity.pt/advisories/cve-2013-3319/; http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/54277
CVE: CVE-2013-4114
Published: 2013-08-16
Description: The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00072.html; http://nagstamon.ifw-dresden.de/docs/security/; http://secunia.com/advisories/54072
CVE: CVE-2013-5301
Published: 2013-08-16
Description: Directory traversal vulnerability in help.php in Trustport Webfilter 5.5.0.2232 allows remote attackers to read arbitrary files via a .. (dot dot) in the hf parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0043.html; http://packetstormsecurity.com/files/122735/Trustport-Webfilter-Traversal-File-Disclosure.html; http://www.securityfocus.com/bid/61662
CVE: CVE-2013-5302
Published: 2013-08-16
Description: SQL injection vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95959; http://secunia.com/advisories/54306; http://typo3.org/extensions/repository/view/ke_search
CVE: CVE-2013-5303
Published: 2013-08-16
Description: Unspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/95967; http://secunia.com/advisories/54350; http://typo3.org/extensions/repository/view/locator
CVE: CVE-2013-5304
Published: 2013-08-16
Description: SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95962; http://secunia.com/advisories/54350; http://typo3.org/extensions/repository/view/locator
CVE: CVE-2013-5305
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95961; http://secunia.com/advisories/54350; http://typo3.org/extensions/repository/view/locator
CVE: CVE-2013-5306
Published: 2013-08-16
Description: SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95963; http://typo3.org/extensions/repository/view/browser; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-013
CVE: CVE-2013-5307
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95960; http://secunia.com/advisories/54306; http://typo3.org/extensions/repository/view/ke_search
CVE: CVE-2013-5308
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in the RealURL Management (realurlmanagement) extension 0.3.4 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95958; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-013; http://www.securityfocus.com/bid/61654
CVE: CVE-2013-5309
Published: 2013-08-16
Description: Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/54293; http://sourceforge.net/p/fudforum/code/5589/; https://exchange.xforce.ibmcloud.com/vulnerabilities/86030
CVE: CVE-2013-5310
Published: 2013-08-16
Description: SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95957; http://typo3.org/extension-manuals/wfqbe/2.0.1/view/1/5/; http://typo3.org/extensions/repository/view/wfqbe
CVE: CVE-2013-1888
Published: 2013-08-17
Description: pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105989.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106311.html
CVE: CVE-2013-2022
Published: 2013-08-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]5921&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7858&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1563&w=2
CVE: CVE-2013-4073
Published: 2013-08-18
Description: The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21; http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-07/msg00042.html
CVE: CVE-2013-4238
Published: 2013-08-18
Description: The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.python.org/issue18709; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00026.html
CVE: CVE-2013-4248
Published: 2013-08-18
Description: The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897; http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
CVE: CVE-2013-4808
Published: 2013-08-18
Description: Unspecified vulnerability in HP Service Manager 7.11, 9.21, 9.30, and 9.31 and Service Center 6.2.8 allows remote attackers to obtain privileged access via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03888320; http://secunia.com/advisories/54546; http://www.securitytracker.com/id/1028912
CVE: CVE-2013-2162
Published: 2013-08-19
Description: Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux creates a configuration file with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711600; http://seclists.org/oss-sec/2013/q2/528; http://secunia.com/advisories/54300
CVE: CVE-2013-2175
Published: 2013-08-19
Description: HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-284
References: http://marc.info/?l=haproxy&m=[PII_REDACTED]9705&w=2; http://rhn.redhat.com/errata/RHSA-2013-1120.html; http://rhn.redhat.com/errata/RHSA-2013-1204.html
CVE: CVE-2013-4881
Published: 2013-08-19
Description: Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html; http://osvdb.org/96009; https://exchange.xforce.ibmcloud.com/vulnerabilities/86286
CVE: CVE-2013-5311
Published: 2013-08-19
Description: Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to (1) browse_videos.php or (2) members.php.  NOTE: the cat parameter is already covered by CVE-2008-4157.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/96222; http://osvdb.org/96223; http://packetstormsecurity.com/files/122746/PHP-VID-XSS-SQL-Injection-CRLF-Injection.html
CVE: CVE-2013-5312
Published: 2013-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to browse_videos.php or the (2) cat parameter to groups.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/96226; http://osvdb.org/show/osvdb/96225; http://packetstormsecurity.com/files/122746/PHP-VID-XSS-SQL-Injection-CRLF-Injection.html
CVE: CVE-2013-5313
Published: 2013-08-19
Description: Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834; https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834
CVE: CVE-2013-5314
Published: 2013-08-19
Description: Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0135.html; https://www.mavitunasecurity.com/xss-vulnerabilities-in-serendipity; http://archives.neohapsis.com/archives/bugtraq/2013-07/0135.html
CVE: CVE-2012-5575
Published: 2013-08-19
Description: Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://cxf.apache.org/cve-2012-5575.html; http://rhn.redhat.com/errata/RHSA-2013-0833.html; http://rhn.redhat.com/errata/RHSA-2013-0834.html
CVE: CVE-2013-0167
Published: 2013-08-19
Description: VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."
CVSS Score: 2.7 (LOW)
References: https://bugzilla.redhat.com/show_bug.cgi?id=893332; https://rhn.redhat.com/errata/RHSA-2013-0886.html; https://rhn.redhat.com/errata/RHSA-2013-0907.html
CVE: CVE-2013-1872
Published: 2013-08-19
Description: The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable assertion and crash) and possibly execute arbitrary code via vectors involving 3d graphics that trigger an out-of-bounds array access, related to the fs_visitor::remove_dead_constants function.  NOTE: this issue might be related to CVE-2013-0796.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2013-0190.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00019.html
CVE: CVE-2013-2136
Published: 2013-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0034.html; http://archives.neohapsis.com/archives/bugtraq/2013-08/0047.html; http://osvdb.org/96074
CVE: CVE-2013-2145
Published: 2013-08-19
Description: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00039.html; http://lists.opensuse.org/opensuse-updates/2013-07/msg00043.html; http://www.openwall.com/lists/oss-security/2013/06/05/16
CVE: CVE-2013-2160
Published: 2013-08-19
Description: The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://jira.codehaus.org/browse/WSTX-285; http://jira.codehaus.org/browse/WSTX-287; http://rhn.redhat.com/errata/RHSA-2013-1028.html
CVE: CVE-2013-3567
Published: 2013-08-19
Description: Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html; http://rhn.redhat.com/errata/RHSA-2013-1283.html
CVE: CVE-2013-4174
Published: 2013-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) flash_uri, (2) flash_width, or (3) flash_height in the scald_flash_scald_prerender function in providers/scald_flash/scald_flash.module; or the (4) caption in the scald_image_scald_prerender function in providers/scald_image/scald_image.module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupalcode.org/project/scald.git/commitdiff/32db1ee; http://osvdb.org/95625; http://seclists.org/fulldisclosure/2013/Jul/224