deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4820
Published: 2013-09-23
Description: Unspecified vulnerability in HP IceWall SSO 8.0 through 10.0, IceWall SSO Agent Option 8.0 through 10.0, IceWall SSO Smart Device Option 10.0, IceWall SSO SAML2 Agent Option 8.0, IceWall SSO JAVA Agent Library 8.0 through 10.0, IceWall Federation Agent 3.0, and IceWall File Manager 3.0 through SP4 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 2.1 (LOW)
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03918632; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03918632; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03918632
CVE: CVE-2013-4821
Published: 2013-09-23
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 7.2.1 allows remote authenticated users to cause a denial of service via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/895524; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862; http://www.kb.cert.org/vuls/id/895524
CVE: CVE-2013-5486
Published: 2013-09-23
Description: Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036.  NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm; http://www.exploit-db.com/exploits/30008; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm
CVE: CVE-2013-5487
Published: 2013-09-23
Description: DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCue77029.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm
CVE: CVE-2013-5490
Published: 2013-09-23
Description: Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary text files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCud80148.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm; http://www.securityfocus.com/bid/62485; https://exchange.xforce.ibmcloud.com/vulnerabilities/87191
CVE: CVE-2013-5502
Published: 2013-09-23
Description: The web interface in Cisco MediaSense does not properly protect the client-server communication channel, which allows remote attackers to obtain sensitive query string or cookie information via unspecified vectors, aka Bug ID CSCuj23344.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/97532; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5502; http://tools.cisco.com/security/center/viewAlert.x?alertId=30934
CVE: CVE-2013-5691
Published: 2013-09-23
Description: The (1) IPv6 and (2) ATM ioctl request handlers in the kernel in FreeBSD 8.3 through 9.2-STABLE do not validate SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR, and SIOCSIFNETMASK requests, which allows local users to perform link-layer actions, cause a denial of service (panic), or possibly gain privileges via a crafted application.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/54861; http://svnweb.freebsd.org/base?view=revision&revision=255442; http://www.debian.org/security/2013/dsa-2769
CVE: CVE-2013-5917
Published: 2013-09-23
Description: SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0102.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0102.html
CVE: CVE-2013-5918
Published: 2013-09-23
Description: Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/ref/97/platinum_seo.txt; http://www.osvdb.org/97263; http://osvdb.org/ref/97/platinum_seo.txt
CVE: CVE-2012-5338
Published: 2013-09-23
Description: Open redirect vulnerability in JForum 2.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnPath parameter in a validateLogin action to jforum.page.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.zerodaylab.com/zdl-advisories/2012-5338.html; http://www.zerodaylab.com/zdl-advisories/2012-5338.html
CVE: CVE-2013-5903
Published: 2013-09-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-5093, CVE-2013-5942, CVE-2013-5943.  Reason: This candidate is a duplicate of CVE-2013-5093, CVE-2013-5942, and CVE-2013-5943.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-5093, CVE-2013-5942, and/or CVE-2013-5943 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2624
Published: 2013-09-23
Description: Stack-based buffer overflow in Logica HotScan allows remote attackers to cause a denial of service (crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/bugtraq/2012/Oct/50; http://seclists.org/bugtraq/2012/Oct/50
CVE: CVE-2013-1431
Published: 2013-09-23
Description: The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2013/q2/438; http://secunia.com/advisories/53779; http://www.debian.org/security/2013/dsa-2702
CVE: CVE-2013-1443
Published: 2013-09-23
Description: The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00035.html; http://python.6.x6.nabble.com/Set-a-reasonable-upper-bound-on-password-length-td5032218.html
CVE: CVE-2013-2217
Published: 2013-09-23
Description: cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
CVSS Score: 1.2 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html; http://www.openwall.com/lists/oss-security/2013/06/27/8; http://www.ubuntu.com/usn/USN-2008-1
CVE: CVE-2013-4294
Published: 2013-09-23
Description: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/97237; http://rhn.redhat.com/errata/RHSA-2013-1285.html; http://seclists.org/oss-sec/2013/q3/586
CVE: CVE-2013-5119
Published: 2013-09-23
Description: Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN token.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0063.html; http://osvdb.org/97290; http://www.securityfocus.com/bid/62407
CVE: CVE-2013-5666
Published: 2013-09-23
Description: The sendfile system-call implementation in sys/kern/uipc_syscalls.c in the kernel in FreeBSD 9.2-RC1 and 9.2-RC2 does not properly pad transmissions, which allows local users to obtain sensitive information (kernel memory) via a length greater than the length of the file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/97142; http://svnweb.freebsd.org/base?view=revision&revision=255442; http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a11.sendfile.asc
CVE: CVE-2013-5710
Published: 2013-09-23
Description: The nullfs implementation in sys/fs/nullfs/null_vnops.c in the kernel in FreeBSD 8.3 through 9.2 allows local users with certain permissions to bypass access restrictions via a hardlink in a nullfs instance to a file in a different instance.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/54861; http://svnweb.freebsd.org/base?view=revision&revision=255442; http://www.debian.org/security/2013/dsa-2769
CVE: CVE-2013-5930
Published: 2013-09-23
Description: Cross-site scripting (XSS) vulnerability in search_residential.php in Real Estate PHP Script allows remote attackers to inject arbitrary web script or HTML via the bos parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/123138/realestatephpscript-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/86986; http://packetstormsecurity.com/files/123138/realestatephpscript-xss.txt
CVE: CVE-2013-5931
Published: 2013-09-23
Description: SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/123138/realestatephpscript-xss.txt; http://packetstormsecurity.com/files/123138/realestatephpscript-xss.txt
CVE: CVE-2013-5932
Published: 2013-09-23
Description: Unspecified vulnerability in WebAdmin in Sophos UTM (aka Astaro Security Gateway) before 9.105 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://blogs.sophos.com/2013/08/21/utm-up2date-9-105-released/; http://secunia.com/advisories/54881; http://www.securitytracker.com/id/1029039
CVE: CVE-2012-4078
Published: 2013-09-24
Description: The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4078; http://www.securitytracker.com/id/1029084; https://exchange.xforce.ibmcloud.com/vulnerabilities/87367
CVE: CVE-2012-4085
Published: 2013-09-24
Description: The Intelligent Platform Management Interface (IPMI) implementation in the Blade Management Controller in Cisco Unified Computing System (UCS) allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4085; http://www.securitytracker.com/id/1029081; https://exchange.xforce.ibmcloud.com/vulnerabilities/87372
CVE: CVE-2012-4087
Published: 2013-09-24
Description: A cluster setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4087; http://www.securitytracker.com/id/1029086; https://exchange.xforce.ibmcloud.com/vulnerabilities/87371
CVE: CVE-2012-4089
Published: 2013-09-24
Description: MCTOOLS in the fabric interconnect in Cisco Unified Computing System (UCS) allows local users to execute arbitrary Baseboard Management Controller (BMC) commands by leveraging (1) local, (2) shell-level, or (3) debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4089; http://www.securitytracker.com/id/1029082; https://exchange.xforce.ibmcloud.com/vulnerabilities/87369
CVE: CVE-2012-4094
Published: 2013-09-24
Description: Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System (UCS) allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4094; http://www.securitytracker.com/id/1029085; https://exchange.xforce.ibmcloud.com/vulnerabilities/87370
CVE: CVE-2013-3589
Published: 2013-09-24
Description: Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/920038; http://www.kb.cert.org/vuls/id/BLUU-997QVW; http://www.kb.cert.org/vuls/id/920038
CVE: CVE-2013-3611
Published: 2013-09-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-3616
Published: 2013-09-24
Description: Cross-site scripting (XSS) vulnerability in the KnowledgeView Editorial and Management application allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/521348; http://www.kb.cert.org/vuls/id/521348
CVE: CVE-2013-5221
Published: 2013-09-24
Description: The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.
CVSS Score: 3.5 (LOW)
References: http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009; http://support.esri.com/en/knowledgebase/techarticles/detail/41497; http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009
CVE: CVE-2013-5911
Published: 2013-09-24
Description: Cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.osvdb.org/97584; https://discussions.nessus.org/message/22174#22174; http://www.osvdb.org/97584
CVE: CVE-2012-4086
Published: 2013-09-25
Description: A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20790.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4086; http://www.securitytracker.com/id/1029083; https://exchange.xforce.ibmcloud.com/vulnerabilities/87368
CVE: CVE-2013-1060
Published: 2013-09-25
Description: A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1060.html; http://www.ubuntu.com/usn/USN-1938-1; http://www.ubuntu.com/usn/USN-1939-1
CVE: CVE-2013-2140
Published: 2013-09-25
Description: The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature.
CVSS Score: 3.8 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=604c499cbbcc3d5fe5fb8d53306aa0fae1990109; http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-2140.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.5
CVE: CVE-2013-4022
Published: 2013-09-25
Description: IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x store unspecified authentication information in a cookie, which allows remote authenticated users to bypass intended access restrictions via unknown vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21650504; https://exchange.xforce.ibmcloud.com/vulnerabilities/85928; http://www-01.ibm.com/support/docview.wss?uid=swg21650504
CVE: CVE-2013-4024
Published: 2013-09-25
Description: IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21650504; https://exchange.xforce.ibmcloud.com/vulnerabilities/85931; http://www-01.ibm.com/support/docview.wss?uid=swg21650504
CVE: CVE-2013-4025
Published: 2013-09-25
Description: IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x do not have an off autocomplete attribute for the login-password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21650504; https://exchange.xforce.ibmcloud.com/vulnerabilities/85933; http://www-01.ibm.com/support/docview.wss?uid=swg21650504
CVE: CVE-2013-4300
Published: 2013-09-25
Description: The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain privileges via PID spoofing.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d661684cf6820331feae71146c35da83d794467e; http://www.openwall.com/lists/oss-security/2013/09/05/3; http://www.ubuntu.com/usn/USN-1995-1
CVE: CVE-2013-4343
Published: 2013-09-25
Description: Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE: CVE-2013-4350
Published: 2013-09-25
Description: The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95ee62083cb6453e056562d91f597552021e6ae7; http://rhn.redhat.com/errata/RHSA-2013-1490.html; http://www.openwall.com/lists/oss-security/2013/09/13/3
CVE: CVE-2013-4777
Published: 2013-09-25
Description: A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init_runit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: https://plus.google.com/[PII_REDACTED][PII_REDACTED]/posts/5ofgPNrSu3J; https://plus.google.com/[PII_REDACTED][PII_REDACTED]/posts/5ofgPNrSu3J
CVE: CVE-2013-5118
Published: 2013-09-25
Description: Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0114.html; https://www.roblest.com/#research:CVE-2013-5118; http://archives.neohapsis.com/archives/bugtraq/2013-09/0114.html
CVE: CVE-2013-5200
Published: 2013-09-25
Description: The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html
CVE: CVE-2013-5373
Published: 2013-09-25
Description: The RemoteClient component in IBM Rational ClearCase 8.0.0.03 through 8.0.0.07, and 8.0.1, uses world-writable permissions for the rcleartool script, which allows local users to gain privileges by appending commands.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648811; https://exchange.xforce.ibmcloud.com/vulnerabilities/86791; http://www-01.ibm.com/support/docview.wss?uid=swg21648811
CVE: CVE-2013-5634
Published: 2013-09-25
Description: arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (NULL pointer dereference, OOPS, and host OS crash) or possibly have unspecified other impact by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl call.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e8180dcaa8470ceca21109f143876fdcd9fe050a; http://www.openwall.com/lists/oss-security/2013/08/26/4; http://www.securityfocus.com/bid/61995
CVE: CVE-2013-5750
Published: 2013-09-25
Description: The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form; http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form