deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3237
Published: 2013-04-22
Description: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d5e0d0f607a7a029c6563a0470d88255c89a8d11; http://www.openwall.com/lists/oss-security/2013/04/14/3; https://github.com/torvalds/linux/commit/d5e0d0f607a7a029c6563a0470d88255c89a8d11
CVE: CVE-2012-5948
Published: 2013-04-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) WebProcess.srv, (2) the html/en/default/ directory, (3) Widget/resource, (4) birt/frameset, or (5) ganttlib/gantt-jws.jnlp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21628847; https://exchange.xforce.ibmcloud.com/vulnerabilities/80628; http://www-01.ibm.com/support/docview.wss?uid=swg21628847
CVE: CVE-2012-5949
Published: 2013-04-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject content, and conduct phishing attacks, via vectors involving (1) the html/en/default/ directory, (2) birt/frameset, (3) WebProcess.srv, (4) sqa/html/en/default/reportTemplate/reportTemplateOrderCols.jsp, or (5) a/html/en/default/om2/omObjectFinder.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21628851; http://www-01.ibm.com/support/docview.wss?uid=swg21628852; https://exchange.xforce.ibmcloud.com/vulnerabilities/80629
CVE: CVE-2012-5950
Published: 2013-04-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to hijack the authentication of arbitrary users for requests that modify data records via vectors involving (1) the html/en/default/ directory or (2) sqa/html/en/default/process/comm/saveProps.jsp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21628849; https://exchange.xforce.ibmcloud.com/vulnerabilities/80630; http://www-01.ibm.com/support/docview.wss?uid=swg21628849
CVE: CVE-2013-0503
Published: 2013-04-23
Description: Cross-site scripting (XSS) vulnerability in the Bookmarks component in IBM Lotus Connections before 4.0 CR3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO74182; http://www-01.ibm.com/support/docview.wss?uid=swg21634538; https://exchange.xforce.ibmcloud.com/vulnerabilities/82265
CVE: CVE-2013-0584
Published: 2013-04-23
Description: The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21634798; https://exchange.xforce.ibmcloud.com/vulnerabilities/83355; http://www-01.ibm.com/support/docview.wss?uid=swg21634798
CVE: CVE-2012-5218
Published: 2013-04-24
Description: HP ElitePad 900 PCs with BIOS F.0x before F.01 Update 1.0.0.8 do not enable the Secure Boot feature, which allows local users to bypass intended BIOS restrictions and boot unintended operating systems via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03727435-1; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03727435-1
CVE: CVE-2012-6140
Published: 2013-04-24
Description: pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129; http://openwall.com/lists/oss-security/2013/04/18/10; https://bugzilla.redhat.com/show_bug.cgi?id=953505
CVE: CVE-2013-0540
Published: 2013-04-24
Description: IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056; https://exchange.xforce.ibmcloud.com/vulnerabilities/82695
CVE: CVE-2013-0541
Published: 2013-04-24
Description: Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger (WIM), allows local users to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM74909; https://exchange.xforce.ibmcloud.com/vulnerabilities/82696
CVE: CVE-2013-0542
Published: 2013-04-24
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM81846; https://exchange.xforce.ibmcloud.com/vulnerabilities/82697
CVE: CVE-2013-0543
Published: 2013-04-24
Description: IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM75582; https://exchange.xforce.ibmcloud.com/vulnerabilities/82759
CVE: CVE-2013-0544
Published: 2013-04-24
Description: Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM82468; https://exchange.xforce.ibmcloud.com/vulnerabilities/82760
CVE: CVE-2013-0565
Published: 2013-04-24
Description: Cross-site scripting (XSS) vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server (WAS) 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21632423; http://www-01.ibm.com/support/docview.wss?uid=swg1PM83402; https://exchange.xforce.ibmcloud.com/vulnerabilities/83138
CVE: CVE-2013-1088
Published: 2013-04-24
Description: Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.novell.com/support/kb/doc.php?id=7010166; https://bugzilla.novell.com/show_bug.cgi?id=726260; http://www.novell.com/support/kb/doc.php?id=7010166
CVE: CVE-2013-1195
Published: 2013-04-24
Description: The time-based ACL implementation on Cisco Adaptive Security Appliances (ASA) devices, and in Cisco Firewall Services Module (FWSM), does not properly handle periodic statements for the time-range command, which allows remote attackers to bypass intended access restrictions by sending network traffic during denied time periods, aka Bug IDs CSCuf79091 and CSCug45850.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1195; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1195
CVE: CVE-2013-1214
Published: 2013-04-24
Description: The scripts editor in Cisco Unified Contact Center Express (aka Unified CCX) does not properly manage privileges for anonymous logins, which allows remote attackers to read arbitrary scripts by visiting the scripts repository directory, aka Bug ID CSCuf77546.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214
CVE: CVE-2013-1217
Published: 2013-04-24
Description: The generic input/output control implementation in Cisco IOS does not properly manage buffers, which allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests at the same time, aka Bug ID CSCub41105.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1217; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1217
CVE: CVE-2013-3268
Published: 2013-04-24
Description: Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.novell.com/support/kb/doc.php?id=7010166; http://www.securityfocus.com/bid/59450; https://bugzilla.novell.com/show_bug.cgi?id=807429
CVE: CVE-2013-1956
Published: 2013-04-24
Description: The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3151527ee007b73a0ebd296010f1c0454a919c7d; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6; http://www.openwall.com/lists/oss-security/2013/04/16/11
CVE: CVE-2013-1957
Published: 2013-04-24
Description: The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=132c94e31b8bca8ea921f9f96a57d684fa4ae0a9; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6; http://www.openwall.com/lists/oss-security/2013/04/16/11
CVE: CVE-2013-1958
Published: 2013-04-24
Description: The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=92f28d973cce45ef5823209aab3138eb45d8b349; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6; http://www.openwall.com/lists/oss-security/2013/04/16/11
CVE: CVE-2013-0728
Published: 2013-04-25
Description: Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote attackers to execute arbitrary code via a long property value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/51647; http://secunia.com/advisories/51647
CVE: CVE-2013-3055
Published: 2013-04-25
Description: Lexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789, which allows remote attackers to execute arbitrary code, change the configuration, or obtain sensitive fleet-management information via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://support.lexmark.com/index?page=content&id=TE530; http://support.lexmark.com/index?page=content&id=TE530
CVE: CVE-2013-1178
Published: 2013-04-25
Description: Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4) and 6.x before 6.1(1), Nexus 5000 and 5500 devices 4.x and 5.x before 5.1(3)N1(1), Nexus 4000 devices before 4.1(2)E1(1h), Nexus 3000 devices 5.x before 5.0(3)U3(1), Nexus 1000V devices 4.x before 4.2(1)SV1(5.1), MDS 9000 devices 4.x and 5.x before 5.2(4), Unified Computing System (UCS) 6100 and 6200 devices before 2.0(2m), and Connected Grid Router (CGR) 1000 devices before CG4(1) allow remote attackers to execute arbitrary code via malformed CDP packets, aka Bug IDs CSCtu10630, CSCtu10551, CSCtu10550, CSCtw56581, CSCtu10548, CSCtu10544, and CSCuf61275.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti
CVE: CVE-2013-1179
Published: 2013-04-25
Description: Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allow remote authenticated users to execute arbitrary code via a crafted SNMP request, aka Bug ID CSCtx54830.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti
CVE: CVE-2013-1180
Published: 2013-04-25
Description: Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allows remote authenticated users to execute arbitrary code via a crafted SNMP request, aka Bug ID CSCtx54822.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti
CVE: CVE-2013-1181
Published: 2013-04-25
Description: Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unified Computing System (UCS) 6200 devices before 2.0(1w) allows remote attackers to cause a denial of service (device reload) by sending a jumbo packet to the management interface, aka Bug IDs CSCtx17544, CSCts10593, and CSCtx95389.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-nxosmulti
CVE: CVE-2013-1182
Published: 2013-04-25
Description: The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti
CVE: CVE-2013-1183
Published: 2013-04-25
Description: Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP packet, aka Bug ID CSCtd32371.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti
CVE: CVE-2013-1184
Published: 2013-04-25
Description: The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request, aka Bug ID CSCtg48206.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti
CVE: CVE-2013-1185
Published: 2013-04-25
Description: The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543.
CVSS Score: 9.3 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti
CVE: CVE-2013-1186
Published: 2013-04-25
Description: Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco Integrated Management Controller (IMC), aka Bug ID CSCts53746.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-ucsmulti
CVE: CVE-2013-1192
Published: 2013-04-25
Description: The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm
CVE: CVE-2013-2305
Published: 2013-04-25
Description: Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://cs.cybozu.co.jp/information/20130415up10.php; http://jvn.jp/en/jp/JVN06251813/374951/index.html; http://jvn.jp/en/jp/JVN06251813/index.html
CVE: CVE-2013-3269
Published: 2013-04-25
Description: Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitrary users for requests that change mobile passwords, a different vulnerability than CVE-2013-2305.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://cs.cybozu.co.jp/information/20130415up11.php; http://jvn.jp/en/jp/JVN06251813/374951/index.html; http://jvn.jp/en/jp/JVN06251813/index.html
CVE: CVE-2013-1215
Published: 2013-04-25
Description: The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local users to gain privileges via unspecified vectors, aka Bug ID CSCuf85295.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1215; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1215
CVE: CVE-2013-2696
Published: 2013-04-25
Description: Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52877; http://wordpress.org/extend/plugins/all-in-one-webmaster/changelog/; http://secunia.com/advisories/52877
CVE: CVE-2013-2767
Published: 2013-04-25
Description: Unspecified vulnerability in Citrix NetScaler Access Gateway Enterprise Edition (AGEE) before 9.3.62.4 and 10.x through 10.0.74.4, and NetScaler AGEE Common Criteria build before 9.3.53.6, allows remote attackers to bypass intended intranet access restrictions via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
References: http://support.citrix.com/article/ctx137238; http://www.kb.cert.org/vuls/id/521612; http://support.citrix.com/article/ctx137238
CVE: CVE-2012-4464
Published: 2013-04-25
Description: Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466.  NOTE: this issue might exist because of a CVE-2011-1005 regression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html; http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
CVE: CVE-2012-4466
Published: 2013-04-25
Description: Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html; http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
CVE: CVE-2013-0175
Published: 2013-04-25
Description: multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/01/11/9; https://gist.github.com/nate/d7f6d9f4925f413621aa; https://github.com/sferik/multi_xml/pull/34