deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4305
Published: 2013-10-11
Description: Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html; http://osvdb.org/96909; http://seclists.org/oss-sec/2013/q3/553
CVE: CVE-2013-4306
Published: 2013-10-11
Description: Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html; http://osvdb.org/96908; http://seclists.org/oss-sec/2013/q3/553
CVE: CVE-2013-5028
Published: 2013-10-11
Description: SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the (1) hardwareType, (2) hardwareStatus, or (3) hardwareLocation parameter in a search command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/123193; http://www.kwoksys.com/wiki/index.php?title=Release_Notes; https://exchange.xforce.ibmcloud.com/vulnerabilities/86363
CVE: CVE-2007-6755
Published: 2013-10-11
Description: The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values.  NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-327
References: http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/; http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html; http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html
CVE: CVE-2009-5136
Published: 2013-10-11
Description: The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://research.cs.wisc.edu/htcondor/manual/v7.6/8_5Stable_Release.html; http://rhn.redhat.com/errata/RHSA-2010-0773.html; https://bugzilla.redhat.com/show_bug.cgi?id=540545
CVE: CVE-2013-3693
Published: 2013-10-11
Description: The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to upload and execute arbitrary packages via a request to port 1098.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://btsc.webapps.blackberry.com/btsc/viewdocument.do%3Bjsessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl; http://secunia.com/advisories/55187; http://btsc.webapps.blackberry.com/btsc/viewdocument.do%3Bjsessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl
CVE: CVE-2013-4137
Published: 2013-10-11
Description: Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x; http://www.openwall.com/lists/oss-security/2013/07/18/5; http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x
CVE: CVE-2013-4167
Published: 2013-10-11
Description: Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=66590&p=299356; http://www.openwall.com/lists/oss-security/2013/07/21/1; http://www.openwall.com/lists/oss-security/2013/07/25/7
CVE: CVE-2013-4173
Published: 2013-10-11
Description: Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://sourceforge.net/projects/xymon/files/Xymon/4.3.12/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:213; http://www.openwall.com/lists/oss-security/2013/07/27/3
CVE: CVE-2013-4203
Published: 2013-10-11
Description: The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2013/08/03/2; https://github.com/rcook/rgpg/commit/b819b13d198495f3ecd2762a0dbe27bb6fae3505; http://www.openwall.com/lists/oss-security/2013/08/03/2
CVE: CVE-2013-4255
Published: 2013-10-11
Description: The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-1171.html; http://rhn.redhat.com/errata/RHSA-2013-1172.html; https://bugzilla.redhat.com/show_bug.cgi?id=919401
CVE: CVE-2013-4319
Published: 2013-10-11
Description: pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2013/dsa-2770; http://www.openwall.com/lists/oss-security/2013/09/09/11; http://www.openwall.com/lists/oss-security/2013/09/09/4
CVE: CVE-2013-4377
Published: 2013-10-11
Description: Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.
CVSS Score: 2.3 (LOW)
CWE: CWE-399
References: http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg03347.html; http://secunia.com/advisories/55015; http://www.openwall.com/lists/oss-security/2013/09/26/5
CVE: CVE-2013-4388
Published: 2013-10-11
Description: Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=9794ec1cd268c04c8bca13a5fae15df6594dff3e; http://secunia.com/advisories/59793; http://www.openwall.com/lists/oss-security/2013/10/01/2
CVE: CVE-2013-6079
Published: 2013-10-11
Description: Buffer overflow in MostGear Soft Easy LAN Folder Share 3.2.0.100 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in the (1) registration code field in the activate license window or the (2) HKLM\SOFTWARE\MostGear\EasyLanFolderShare_V1\License registry key. NOTE: it is not clear from the original report whether this issue crosses privilege boundaries.  If not, then it should not be included in CVE.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/94390; http://packetstormsecurity.com/files/122677; http://www.exploit-db.com/exploits/26214
CVE: CVE-2012-4105
Published: 2013-10-13
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (component crash) via crafted "debug hardware" parameters, aka Bug ID CSCtq86468.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/98437; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4105; http://www.securityfocus.com/bid/62980
CVE: CVE-2012-4106
Published: 2013-10-13
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) uses the same privilege level for execution of every script, which allows local users to gain privileges and execute arbitrary commands via an unspecified script-execution approach, aka Bug ID CSCtq86477.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/98354; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4106; http://www.securityfocus.com/bid/62981
CVE: CVE-2012-4107
Published: 2013-10-13
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted parameters to a file-related command, aka Bug ID CSCtq86489.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/98355; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4107; http://osvdb.org/98355
CVE: CVE-2012-4108
Published: 2013-10-13
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4108; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4108
CVE: CVE-2012-4709
Published: 2013-10-13
Description: Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-276-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-276-01
CVE: CVE-2013-1870
Published: 2013-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-1869.  Reason: This candidate is a reservation duplicate of CVE-2013-1869.  Notes: All CVE users should reference CVE-2013-1869 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2366
Published: 2013-10-13
Description: Unspecified vulnerability in HP Business Process Monitor 9.13.1 patch 1 and 9.22 patch 1 allows remote attackers to execute arbitrary code and obtain sensitive information via unknown vectors, aka ZDI-CAN-1802.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03844594; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03844594
CVE: CVE-2013-2749
Published: 2013-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-3528.  Reason: This candidate is a reservation duplicate of CVE-2013-3528.  Notes: All CVE users should reference CVE-2013-3528 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2787
Published: 2013-10-13
Description: Alstom e-terracontrol 3.5, 3.6, and 3.7 allows remote attackers to cause a denial of service (infinite loop) via crafted DNP3 packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-282-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-282-01
CVE: CVE-2013-3415
Published: 2013-10-13
Description: Cisco Adaptive Security Appliance (ASA) Software 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3) does not properly manage memory upon an AnyConnect SSL VPN client disconnection, which allows remote attackers to cause a denial of service (memory consumption, and forwarding outage or system hang) via packets to the disconnected machine's IP address, aka Bug ID CSCtt36737.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3415; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-4056
Published: 2013-10-13
Description: Cross-site request forgery (CSRF) vulnerability in the Data Quality Console and Information Analyzer components in IBM InfoSphere Information Server 8.7 through FP2 and 9.1 through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652413; https://exchange.xforce.ibmcloud.com/vulnerabilities/86545; http://www-01.ibm.com/support/docview.wss?uid=swg21652413
CVE: CVE-2013-4398
Published: 2013-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-4804
Published: 2013-10-13
Description: Unspecified vulnerability in HP Business Process Monitor 9.13.1 patch 1 and 9.22 patch 1 allows remote attackers to execute arbitrary code and obtain sensitive information via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03844594; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03844594
CVE: CVE-2013-4822
Published: 2013-10-13
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943425; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943425
CVE: CVE-2013-4823
Published: 2013-10-13
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1607.
CVSS Score: 5.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943425; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943425
CVE: CVE-2013-4824
Published: 2013-10-13
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547
CVE: CVE-2013-4825
Published: 2013-10-13
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass intended access restrictions via unknown vectors, aka ZDI-CAN-1645.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547
CVE: CVE-2013-4826
Published: 2013-10-13
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1647.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547
CVE: CVE-2013-4827
Published: 2013-10-13
Description: SQL injection vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka ZDI-CAN-1664.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03943547
CVE: CVE-2013-5506
Published: 2013-10-13
Description: The authorization functionality in Cisco Firewall Services Module (FWSM) 3.1.x and 3.2.x before 3.2(25) and 4.x before 4.1(13), when multiple-context mode is enabled, allows local users to read or modify any context's configuration via unspecified commands, aka Bug ID CSCue46080.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-fwsm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-fwsm
CVE: CVE-2013-5507
Published: 2013-10-13
Description: The IPsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(1.7), when an IPsec VPN tunnel is enabled, allows remote attackers to cause a denial of service (device reload) via a (1) ICMP or (2) ICMPv6 packet that is improperly handled during decryption, aka Bug ID CSCue18975.
CVSS Score: 7.1 (HIGH)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5507; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5508
Published: 2013-10-13
Description: The SQL*Net inspection engine in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12), 8.x before 8.2(5.44), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.6), 9.0.x before 9.0(2.10), and 9.1.x before 9.1(2) and Firewall Services Module (FWSM) 3.1.x and 3.2.x before 3.2(27) and 4.x before 4.1(14) allows remote attackers to cause a denial of service (device reload) via crafted segmented Transparent Network Substrate (TNS) packets, aka Bug ID CSCub98434.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-fwsm; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5508
CVE: CVE-2013-5509
Published: 2013-10-13
Description: The SSL implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0 before 9.0(2.6) and 9.1 before 9.1(2) allows remote attackers to bypass authentication, and obtain VPN access or administrative access, via a crafted X.509 client certificate, aka Bug ID CSCuf52468.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5509; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5510
Published: 2013-10-13
Description: The remote-access VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12), 8.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.6.x before 8.6(1.12), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.5), when an override-account-disable option is enabled, does not properly parse AAA LDAP responses, which allows remote attackers to bypass authentication via a VPN connection attempt, aka Bug ID CSCug83401.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5510; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5511
Published: 2013-10-13
Description: The Adaptive Security Device Management (ASDM) remote-management feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.6) does not properly implement the authentication-certificate option, which allows remote attackers to bypass authentication via a TCP session to an ASDM interface, aka Bug ID CSCuh44815.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5511; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5512
Published: 2013-10-13
Description: Race condition in the HTTP Deep Packet Inspection (DPI) feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(5.5), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.4), 9.0.x before 9.0(1.4), and 9.1.x before 9.1(1.2), in certain conditions involving the spoof-server option or ActiveX or Java response inspection, allows remote attackers to cause a denial of service (device reload) via a crafted HTTP response, aka Bug ID CSCud37992.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5512; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5513
Published: 2013-10-13
Description: Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(7), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.3), and 9.1.x before 9.1(1.8), when the DNS ALPI engine is enabled for TCP, allows remote attackers to cause a denial of service (device reload) via crafted TCP DNS packets, aka Bug ID CSCug03975.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5513; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa