deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5493
Published: 2013-09-13
Description: The diagnostic module in the firmware on Cisco Virtualization Experience Client 6000 devices allows local users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors, aka Bug ID CSCug68407.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/97239; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5493; http://tools.cisco.com/security/center/viewAlert.x?alertId=30777
CVE: CVE-2013-5649
Published: 2013-09-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow (1) remote attackers to inject arbitrary web script or HTML via vectors involving login pages, and allow (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a support page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kb.juniper.net/JSA10589; http://osvdb.org/97240; http://kb.juniper.net/JSA10589
CVE: CVE-2013-2888
Published: 2013-09-16
Description: Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4608&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://rhn.redhat.com/errata/RHSA-2013-1490.html
CVE: CVE-2013-2889
Published: 2013-09-16
Description: drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4614&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://rhn.redhat.com/errata/RHSA-2013-1645.html
CVE: CVE-2013-2890
Published: 2013-09-16
Description: drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SONY is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4616&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://marc.info/?l=linux-input&m=[PII_REDACTED]4616&w=1
CVE: CVE-2013-2891
Published: 2013-09-16
Description: drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4622&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://marc.info/?l=linux-input&m=[PII_REDACTED]4622&w=1
CVE: CVE-2013-2892
Published: 2013-09-16
Description: drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4625&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://rhn.redhat.com/errata/RHSA-2013-1490.html
CVE: CVE-2013-2893
Published: 2013-09-16
Description: The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://marc.info/?l=linux-input&m=[PII_REDACTED]4627&w=1
CVE: CVE-2013-2894
Published: 2013-09-16
Description: drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4628&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://www.ubuntu.com/usn/USN-2020-1
CVE: CVE-2013-2895
Published: 2013-09-16
Description: drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4631&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://rhn.redhat.com/errata/RHSA-2013-1490.html
CVE: CVE-2013-2896
Published: 2013-09-16
Description: drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4633&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://rhn.redhat.com/errata/RHSA-2013-1490.html
CVE: CVE-2013-2897
Published: 2013-09-16
Description: Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://marc.info/?l=linux-input&m=[PII_REDACTED]4635&w=1
CVE: CVE-2013-2898
Published: 2013-09-16
Description: drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://marc.info/?l=linux-input&m=[PII_REDACTED]4645&w=1; http://openwall.com/lists/oss-security/2013/08/28/13; http://www.ubuntu.com/usn/USN-1995-1
CVE: CVE-2013-2899
Published: 2013-09-16
Description: drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://marc.info/?l=linux-input&m=[PII_REDACTED]4649&w=1
CVE: CVE-2013-4809
Published: 2013-09-16
Description: Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409; http://secunia.com/advisories/54788; http://www.securitytracker.com/id/1029010
CVE: CVE-2013-4810
Published: 2013-09-16
Description: HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3753&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3668&w=2
CVE: CVE-2013-4811
Published: 2013-09-16
Description: UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409; http://secunia.com/advisories/54788; http://www.securitytracker.com/id/1029010
CVE: CVE-2013-4812
Published: 2013-09-16
Description: UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409; http://secunia.com/advisories/54788; http://www.securitytracker.com/id/1029010
CVE: CVE-2013-4813
Published: 2013-09-16
Description: The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute arbitrary commands via a HEAD request, aka ZDI-CAN-1745.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409; http://secunia.com/advisories/54788; http://www.securitytracker.com/id/1029010
CVE: CVE-2013-5717
Published: 2013-09-16
Description: The Bluetooth HCI ACL dissector in Wireshark 1.10.x before 1.10.2 does not properly maintain a certain free list, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that is not properly handled by the wmem_block_alloc function in epan/wmem/wmem_allocator_block.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=51130; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8827; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19030
CVE: CVE-2013-5718
Published: 2013-09-16
Description: The dissect_nbap_T_dCH_ID function in epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not restrict the dch_id value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=51195; http://lists.opensuse.org/opensuse-updates/2013-09/msg00050.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00052.html
CVE: CVE-2013-5719
Published: 2013-09-16
Description: epan/dissectors/packet-assa_r3.c in the ASSA R3 dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=51196; http://lists.opensuse.org/opensuse-updates/2013-09/msg00050.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00052.html
CVE: CVE-2013-5720
Published: 2013-09-16
Description: Buffer overflow in the RTPS dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00050.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00052.html; http://secunia.com/advisories/54812
CVE: CVE-2013-5721
Published: 2013-09-16
Description: The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=51603; http://lists.opensuse.org/opensuse-updates/2013-09/msg00050.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00052.html
CVE: CVE-2013-5722
Published: 2013-09-16
Description: Unspecified vulnerability in the LDAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00050.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00052.html; http://secunia.com/advisories/54812
CVE: CVE-2013-1025
Published: 2013-09-16
Description: Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JBIG2 data in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html; http://secunia.com/advisories/54886
CVE: CVE-2013-1026
Published: 2013-09-16
Description: Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html; http://secunia.com/advisories/54886
CVE: CVE-2013-1027
Published: 2013-09-16
Description: Installer in Apple Mac OS X before 10.8.5 provides an option to continue a package's installation after encountering a revoked certificate, which might allow user-assisted remote attackers to execute arbitrary code via a crafted package.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-1028
Published: 2013-09-16
Description: The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateways, which allows man-in-the-middle attackers to spoof security gateways and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html; http://secunia.com/advisories/54886
CVE: CVE-2013-1029
Published: 2013-09-16
Description: The kernel in Apple Mac OS X before 10.8.5 allows remote attackers to cause a denial of service (panic) via crafted IGMP packets that leverage incorrect, extraneous code in the IGMP parser.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-1030
Published: 2013-09-16
Description: mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-1031
Published: 2013-09-16
Description: Power Management in Apple Mac OS X before 10.8.5 does not properly perform locking upon occurrences of a power assertion, which allows physically proximate attackers to bypass intended access restrictions by visiting an unattended workstation on which a locking failure had prevented the startup of the screen saver.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-1032
Published: 2013-09-16
Description: QuickTime in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted idsc atom in a QuickTime movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://support.apple.com/kb/HT6151
CVE: CVE-2013-1033
Published: 2013-09-16
Description: Screen Lock in Apple Mac OS X before 10.8.5 does not properly track sessions, which allows remote authenticated users to bypass locking by leveraging screen-sharing access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-1824
Published: 2013-09-16
Description: The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=188c196d4da60bdde9190d2fc532650d17f7af2d; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=afe98b7829d50806559acac9b530acb8283c3bf4; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-4704
Published: 2013-09-16
Description: Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN77455005/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000088; http://www.chama.ne.jp/cart.htm
CVE: CVE-2013-5494
Published: 2013-09-16
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified MeetingPlace Solution, as used in Unified MeetingPlace Web Conferencing and Unified MeetingPlace, allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCui45209 and CSCui44674.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5494; http://www.securitytracker.com/id/1029037; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5494
CVE: CVE-2013-5495
Published: 2013-09-16
Description: Cross-site scripting (XSS) vulnerability in the web framework in the Application Server in Cisco Unified MeetingPlace allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui44681.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5495; http://www.securitytracker.com/id/1029038; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5495
CVE: CVE-2013-5496
Published: 2013-09-16
Description: Open Network Environment Platform (ONEP) in Cisco NX-OS allows remote authenticated users to cause a denial of service (network-element reload) via a crafted packet, aka Bug ID CSCui51551.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5496; http://www.securitytracker.com/id/1029036; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5496
CVE: CVE-2012-6087
Published: 2013-09-16
Description: repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40615; http://www.openwall.com/lists/oss-security/2013/01/03/1; https://moodle.org/mod/forum/discuss.php?d=238393
CVE: CVE-2013-4313
Published: 2013-09-16
Description: Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40676; https://moodle.org/mod/forum/discuss.php?d=238396; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40676
CVE: CVE-2013-4341
Published: 2013-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41623; http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html; https://moodle.org/mod/forum/discuss.php?d=238399
CVE: CVE-2013-5674
Published: 2013-09-16
Description: badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924; https://moodle.org/mod/forum/discuss.php?d=238397; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924
CVE: CVE-2013-4047
Published: 2013-09-16
Description: Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote attackers to inject arbitrary web script or HTML via a crafted link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648929; https://exchange.xforce.ibmcloud.com/vulnerabilities/86440; http://www-01.ibm.com/support/docview.wss?uid=swg21648929