deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3162
Published: 2013-07-10
Description: Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3115.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17205
CVE: CVE-2013-3163
Published: 2013-07-10
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17363
CVE: CVE-2013-3164
Published: 2013-07-10
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17376
CVE: CVE-2013-3166
Published: 2013-07-10
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via vectors involving incorrect auto-selection of the Shift JIS encoding, leading to cross-domain scrolling events, aka "Shift JIS Character Encoding Vulnerability," a different vulnerability than CVE-2013-0015.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17306
CVE: CVE-2013-3167
Published: 2013-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17293
CVE: CVE-2013-3171
Published: 2013-07-10
Description: The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship, aka "Delegate Serialization Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16867
CVE: CVE-2013-3172
Published: 2013-07-10
Description: Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to cause a denial of service (system hang) via a crafted application that leverages improper handling of objects in memory, aka "Win32k Buffer Overflow Vulnerability."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17188; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053
CVE: CVE-2013-3173
Published: 2013-07-10
Description: Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Buffer Overwrite Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17148
CVE: CVE-2013-3174
Published: 2013-07-10
Description: DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16883
CVE: CVE-2013-3178
Published: 2013-07-10
Description: Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted Silverlight application, aka "Null Pointer Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id/1028755; http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052
CVE: CVE-2013-2853
Published: 2013-07-10
Description: The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline), which allows man-in-the-middle attackers to have an unspecified impact via vectors that trigger header truncation.
CVSS Score: 6.8 (MEDIUM)
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=44b400c80726ee5d205a27730a0c846be656a071; http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=f4f9f4948de5a59462e13ad712d7d9117238aeea; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
CVE: CVE-2013-2867
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 does not properly prevent pop-under windows, which allows remote attackers to have an unspecified impact via a crafted web site.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724; https://code.google.com/p/chromium/issues/detail?id=252216
CVE: CVE-2013-2868
Published: 2013-07-10
Description: common/extensions/sync_helper.cc in Google Chrome before 28.0.1500.71 proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting, which might allow remote attackers to trigger unwanted extension changes via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=84ece2d5af0e6f746ca63e483e2dbdbcab8b1e6c; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724
CVE: CVE-2013-2869
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724; https://code.google.com/p/chromium/issues/detail?id=245153
CVE: CVE-2013-2870
Published: 2013-07-10
Description: Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=2b0ff6d8a832f4fe5c187b17342b56675fbf7b96; http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=[PII_REDACTED]f44d7c023b28a697ada40064c681a6; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
CVE: CVE-2013-2871
Published: 2013-07-10
Description: Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2013-2872
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it easier for remote attackers to defeat cryptographic protection mechanisms in third-party components via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=5e3678ea33ab00b5977bde219cd9ec6f1768d78a; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=242702
CVE: CVE-2013-2873
Published: 2013-07-10
Description: Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-416
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=4d64b2d296d5de448ab04c4e5af5c7daa2d8e8f8; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724
CVE: CVE-2013-2874
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access to screen data via vectors involving IPC transmission of GL textures.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=237611; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17142
CVE: CVE-2013-2875
Published: 2013-07-10
Description: core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2013-2876
Published: 2013-07-10
Description: browser/extensions/api/tabs/tabs_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of screenshots by extensions, which allows remote attackers to obtain sensitive information about the content of a previous page via vectors involving an interstitial page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=ac41418e77bf9d82a6e7875c504fad5fd2ba1f7f; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724
CVE: CVE-2013-2877
Published: 2013-07-10
Description: parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: ftp://xmlsoft.org/libxml2/libxml2-2.9.0.tar.gz; http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=e5d7f7e5dc21d3ae7be3cbb949ac4d8701e06de1; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
CVE: CVE-2013-2878
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handling of text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724; https://code.google.com/p/chromium/issues/detail?id=177197
CVE: CVE-2013-2879
Published: 2013-07-10
Description: Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=8a8eb83276778c9fbcf9ebcd[PII_REDACTED]b73074; http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=f0aa298677a1afb9a40b36e32bc9c4d9b4861eac; http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
CVE: CVE-2013-2880
Published: 2013-07-10
Description: Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html; http://www.debian.org/security/2013/dsa-2724; https://code.google.com/p/chromium/issues/detail?id=160450
CVE: CVE-2013-3344
Published: 2013-07-10
Description: Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html; http://www.adobe.com/support/security/bulletins/apsb13-17.html; http://www.securityfocus.com/bid/61043
CVE: CVE-2013-3345
Published: 2013-07-10
Description: Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html; http://www.adobe.com/support/security/bulletins/apsb13-17.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html
CVE: CVE-2013-3347
Published: 2013-07-10
Description: Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via PCM data that is not properly handled during resampling.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html; http://www.adobe.com/support/security/bulletins/apsb13-17.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html
CVE: CVE-2013-3348
Published: 2013-07-10
Description: Adobe Shockwave Player before 12.0.3.133 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-18.html; http://www.securitytracker.com/id/1028758; http://www.adobe.com/support/security/bulletins/apsb13-18.html
CVE: CVE-2013-3349
Published: 2013-07-10
Description: Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.adobe.com/support/security/bulletins/apsb13-19.html; http://www.securitytracker.com/id/1028757; http://www.adobe.com/support/security/bulletins/apsb13-19.html
CVE: CVE-2013-3350
Published: 2013-07-10
Description: Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets.
CVSS Score: 10.0 (HIGH)
References: http://stackoverflow.com/questions/17351214/cf10-websocket-p2p-can-invoke-any-public-functions-in-any-cfc-from-javascript-h; http://www.adobe.com/support/security/bulletins/apsb13-19.html; http://www.securitytracker.com/id/1028757
CVE: CVE-2012-5855
Published: 2013-07-10
Description: The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC.  NOTE: it is not clear whether this issue crosses privilege boundaries or whether it can be exploited without user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]2215&w=2; http://www.securityfocus.com/archive/1/524626; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16781
CVE: CVE-2013-1868
Published: 2013-07-10
Description: Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]7336&w=2; http://secunia.com/advisories/59793; http://www.securityfocus.com/bid/57079
CVE: CVE-2013-1954
Published: 2013-07-10
Description: The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=b31ce523331aa3a6e620b68cdfe3f161d519631e; http://marc.info/?l=oss-security&m=[PII_REDACTED]6152&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1731&w=2
CVE: CVE-2013-1965
Published: 2013-07-10
Description: Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://struts.apache.org/development/2.x/docs/s2-012.html; http://www.securityfocus.com/bid/60082; https://bugzilla.redhat.com/show_bug.cgi?id=967655
CVE: CVE-2013-1966
Published: 2013-07-10
Description: Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://struts.apache.org/development/2.x/docs/s2-013.html; http://www.securityfocus.com/bid/60166; https://bugzilla.redhat.com/show_bug.cgi?id=967656
CVE: CVE-2013-2115
Published: 2013-07-10
Description: Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: http://struts.apache.org/development/2.x/docs/s2-014.html; http://www.securityfocus.com/bid/60167; https://bugzilla.redhat.com/show_bug.cgi?id=967656
CVE: CVE-2013-3245
Published: 2013-07-10
Description: plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception.  NOTE: the vendor disputes the severity and claimed vulnerability type of this issue, stating "This PoC crashes VLC, indeed, but does nothing more... this is not an integer overflow error, but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort, not execute random code, on my Linux 64bits machine." A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read, but the affected instruction does not involve a register that directly influences control flow
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-125
References: http://seclists.org/fulldisclosure/2013/Jul/71; http://seclists.org/fulldisclosure/2013/Jul/77; http://seclists.org/fulldisclosure/2013/Jul/79
CVE: CVE-2013-1896
Published: 2013-07-10
Description: mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html
CVE: CVE-2013-3400
Published: 2013-07-10
Description: The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users to execute arbitrary commands via crafted "install license" arguments, aka Bug ID CSCuh30824.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3400; http://www.securitytracker.com/id/1028763; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3400
CVE: CVE-2013-3405
Published: 2013-07-10
Description: The web portal in TC software on Cisco TelePresence endpoints does not require an exact password match during a login attempt by a user who has not configured a password, which allows remote attackers to bypass authentication by sending an arbitrary password, aka Bug ID CSCud96071.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3405; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3405