deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3387
Published: 2013-08-25
Description: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (disk consumption) via a flood of TCP packets to port 5400, leading to large error-log files, aka Bug ID CSCua42724.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm
CVE: CVE-2013-3388
Published: 2013-08-25
Description: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets to port 44444, aka Bug ID CSCtz92776.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm
CVE: CVE-2013-3389
Published: 2013-08-25
Description: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets to port (1) 61615 or (2) 61616, aka Bug ID CSCtz90114.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm
CVE: CVE-2013-3390
Published: 2013-08-25
Description: Memory leak in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug ID CSCub59158.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-hcm
CVE: CVE-2013-3459
Published: 2013-08-25
Description: Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6a does not properly handle errors, which allows remote attackers to cause a denial of service (service disruption) via malformed registration messages, aka Bug ID CSCuf93466.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm; http://www.securitytracker.com/id/1028938; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm
CVE: CVE-2013-3460
Published: 2013-08-25
Description: Memory leak in Cisco Unified Communications Manager (Unified CM) 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(1) allows remote attackers to cause a denial of service (service disruption) via a high rate of UDP packets, aka Bug ID CSCub85597.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm; http://www.securitytracker.com/id/1028938; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm
CVE: CVE-2013-3461
Published: 2013-08-25
Description: Cisco Unified Communications Manager (Unified CM) 8.5(x) and 8.6(x) before 8.6(2a)su3 and 9.x before 9.1(1) does not properly restrict the rate of SIP packets, which allows remote attackers to cause a denial of service (memory and CPU consumption, and service disruption) via a flood of UDP packets to port 5060, aka Bug ID CSCub35869.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm; http://www.securitytracker.com/id/1028938; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm
CVE: CVE-2013-3462
Published: 2013-08-25
Description: Buffer overflow in Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6, 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(2) allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Bug ID CSCud54358.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm; http://www.securitytracker.com/id/1028938; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cucm
CVE: CVE-2013-4205
Published: 2013-08-25
Description: Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6160968cee8b90a5dd95318d716e31d7775c4ef3; http://twitter.com/grsecurity/statuses/[PII_REDACTED]36978944; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.6
CVE: CVE-2013-4216
Published: 2013-08-25
Description: The Trace_OpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses world-writable permissions for wimaxd.log, which allows local users to cause a denial of service (data corruption) by modifying this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/08/08/17; https://bugzilla.redhat.com/show_bug.cgi?id=911122; http://www.openwall.com/lists/oss-security/2013/08/08/17
CVE: CVE-2013-4217
Published: 2013-08-25
Description: The OSAL_Crypt_SetEncryptedPassword function in InfraStack/OSDependent/Linux/OSAL/Services/wimax_osal_crypt_services.c in the OSAL crypt module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices logs a cleartext password during certain attempts to set a password, which allows local users to obtain sensitive information by reading a log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2013/08/08/17; https://bugzilla.redhat.com/show_bug.cgi?id=911121; http://www.openwall.com/lists/oss-security/2013/08/08/17
CVE: CVE-2013-4218
Published: 2013-08-25
Description: The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses the same RSA private key in supplicant_key.pem on all systems, which allows local users to obtain sensitive information via unspecified decryption operations.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2013/08/08/17; https://bugzilla.redhat.com/show_bug.cgi?id=911126; http://www.openwall.com/lists/oss-security/2013/08/08/17
CVE: CVE-2013-4219
Published: 2013-08-25
Description: Multiple integer overflows in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices allow remote attackers to cause a denial of service (component crash) or possibly execute arbitrary code via an L5 connection with a crafted PDU value that triggers a heap-based buffer overflow within (1) L5SocketsDispatcher.c or (2) L5Connector.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://www.openwall.com/lists/oss-security/2013/08/08/17; https://bugzilla.redhat.com/show_bug.cgi?id=911129; http://www.openwall.com/lists/oss-security/2013/08/08/17
CVE: CVE-2013-4220
Published: 2013-08-25
Description: The bad_mode function in arch/arm64/kernel/traps.c in the Linux kernel before 3.9.5 on the ARM64 platform allows local users to cause a denial of service (system crash) via vectors involving an attempted register access that triggers an unexpected value in the Exception Syndrome Register (ESR).
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9955ac47f4ba1c95ecb6092aeaefb40a22e99268; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.9.5; http://www.openwall.com/lists/oss-security/2013/08/08/12
CVE: CVE-2013-4247
Published: 2013-08-25
Description: Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1fc29bacedeabb278080e31bb9c1ecb49f143c3b; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.9.6; http://www.openwall.com/lists/oss-security/2013/08/14/10
CVE: CVE-2013-4254
Published: 2013-08-25
Description: The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c95eb3184ea1a3a2551df57190c81da695e2144b; http://secunia.com/advisories/54494; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.8
CVE: CVE-2013-5578
Published: 2013-08-25
Description: Buffer overflow in the ToDot method in the WINGRAPHVIZLib.NEATO ActiveX control in WinGraphviz.dll in StarUML allows remote attackers to execute arbitrary code via a long argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/27317/; http://www.exploit-db.com/exploits/27317/
CVE: CVE-2013-0566
Published: 2013-08-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) Accelerator JSPs, (2) Organization Administration Console JSPs, and (3) Administration Console JSPs in WebSphere Commerce Tools in IBM WebSphere Commerce 5.6.1.0 through 5.6.1.5, 6.0.0.0 through 6.0.0.11, and 7.0.0.0 through 7.0.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR46776; http://www.ibm.com/support/docview.wss?uid=swg21647750; https://exchange.xforce.ibmcloud.com/vulnerabilities/83139
CVE: CVE-2013-0586
Published: 2013-08-27
Description: Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645566; https://exchange.xforce.ibmcloud.com/vulnerabilities/83380; http://www-01.ibm.com/support/docview.wss?uid=swg21645566
CVE: CVE-2013-0590
Published: 2013-08-27
Description: Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0591.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21647740; https://exchange.xforce.ibmcloud.com/vulnerabilities/83814; http://www-01.ibm.com/support/docview.wss?uid=swg21647740
CVE: CVE-2013-0591
Published: 2013-08-27
Description: Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0590.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21647740; https://exchange.xforce.ibmcloud.com/vulnerabilities/83381; http://www-01.ibm.com/support/docview.wss?uid=swg21647740
CVE: CVE-2013-0595
Published: 2013-08-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21647740; https://exchange.xforce.ibmcloud.com/vulnerabilities/83431; https://www-01.ibm.com/support/docview.wss?uid=swg21671622
CVE: CVE-2013-2978
Published: 2013-08-27
Description: Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2988.
CVSS Score: 2.1 (LOW)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645566; https://exchange.xforce.ibmcloud.com/vulnerabilities/83971; http://www-01.ibm.com/support/docview.wss?uid=swg21645566
CVE: CVE-2013-2988
Published: 2013-08-27
Description: Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2978.
CVSS Score: 2.6 (LOW)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645566; https://exchange.xforce.ibmcloud.com/vulnerabilities/84010; http://www-01.ibm.com/support/docview.wss?uid=swg21645566
CVE: CVE-2013-4266
Published: 2013-08-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-5123.  Reason: This candidate is a reservation duplicate of CVE-2013-5123.  Notes: All CVE users should reference CVE-2013-5123 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4328
Published: 2013-08-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4238.  Reason: This candidate is a duplicate of CVE-2013-4238.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-4238 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4973
Published: 2013-08-27
Description: Stack-based buffer overflow in RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted .rmp file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08232013_player/en/; http://www.kb.cert.org/vuls/id/246524; http://www.securityfocus.com/bid/61989
CVE: CVE-2013-4974
Published: 2013-08-27
Description: RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed RealMedia file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08232013_player/en/; http://www.securityfocus.com/bid/61990; http://service.real.com/realplayer/security/08232013_player/en/
CVE: CVE-2013-2782
Published: 2013-08-28
Description: Schneider Electric Trio J-Series License Free Ethernet Radio with firmware 3.6.0 through 3.6.3 uses the same AES encryption key across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-234-01; http://www.schneider-electric.com/download/ww/en/file/141141292-SEVD-2013-143-01.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-13-234-01
CVE: CVE-2013-2804
Published: 2013-08-28
Description: The DNP Master Driver in Software Toolbox TOP Server before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-234-02; http://support.softwaretoolbox.com/app/answers/detail/a_id/3014; http://ics-cert.us-cert.gov/advisories/ICSA-13-234-02
CVE: CVE-2013-3583
Published: 2013-08-28
Description: Cross-site request forgery (CSRF) vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/595142; http://www.kb.cert.org/vuls/id/595142
CVE: CVE-2013-3584
Published: 2013-08-28
Description: Cross-site scripting (XSS) vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/595142; http://www.kb.cert.org/vuls/id/595142
CVE: CVE-2013-3585
Published: 2013-08-28
Description: Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive information via vectors involving (1) direct access to a file or (2) the user-setup web page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/882286; http://www.kb.cert.org/vuls/id/882286
CVE: CVE-2013-3586
Published: 2013-08-28
Description: Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/882286; http://www.kb.cert.org/vuls/id/882286
CVE: CVE-2013-3590
Published: 2013-08-28
Description: Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitrary code by uploading an executable file with the image/jpeg content type, and then accessing this file via unspecified vectors, as demonstrated by access to a JSP file.
CVSS Score: 6.8 (MEDIUM)
References: http://buddhalabs.com/Advisories/WebAdvisories.html; http://www.kb.cert.org/vuls/id/592942; http://www.searchblox.com/developers-2/change-log
CVE: CVE-2013-3597
Published: 2013-08-28
Description: servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://buddhalabs.com/Advisories/WebAdvisories.html; http://www.kb.cert.org/vuls/id/592942; http://www.searchblox.com/developers-2/change-log
CVE: CVE-2013-3598
Published: 2013-08-28
Description: Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://buddhalabs.com/Advisories/WebAdvisories.html; http://osvdb.org/96619; http://www.kb.cert.org/vuls/id/592942
CVE: CVE-2013-2353
Published: 2013-08-28
Description: Unspecified vulnerability in HP StoreOnce D2D Backup System 1.x before 1.2.19 and 2.x before 2.3.0 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03828580; http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03828580
CVE: CVE-2013-3077
Published: 2013-08-28
Description: Multiple integer overflows in the IP_MSFILTER and IPV6_MSFILTER features in (1) sys/netinet/in_mcast.c and (2) sys/netinet6/in6_mcast.c in the multicast implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE allow local users to bypass intended restrictions on kernel-memory read and write operations, and consequently gain privileges, via vectors involving a large number of source-filter entries.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://svnweb.freebsd.org/base?view=revision&revision=254629; http://www.freebsd.org/security/advisories/FreeBSD-SA-13:09.ip_multicast.asc; http://svnweb.freebsd.org/base?view=revision&revision=254629
CVE: CVE-2013-3271
Published: 2013-08-28
Description: EMC RSA Authentication Agent for PAM 7.0 before 7.0.2.1 enforces the maximum number of login attempts within the PAM-enabled application codebase, instead of within the Agent codebase, which makes it easier for remote attackers to discover correct login credentials via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0123.html; http://archives.neohapsis.com/archives/bugtraq/2013-08/0123.html
CVE: CVE-2013-3582
Published: 2013-08-28
Description: Buffer overflow in Dell BIOS on Dell Latitude D###, E####, XT2, and Z600 devices, and Dell Precision M#### devices, allows local users to bypass intended BIOS signing requirements and install arbitrary BIOS images by leveraging administrative privileges and providing a crafted rbu_packet.pktNum value in conjunction with a crafted rbu_packet.pktSize value.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/912156; http://www.kb.cert.org/vuls/id/BLUU-99HSLA; https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf
CVE: CVE-2013-4033
Published: 2013-08-28
Description: IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute DML statements by leveraging EXPLAIN authority.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC94523; http://www-01.ibm.com/support/docview.wss?uid=swg1IC94756; http://www-01.ibm.com/support/docview.wss?uid=swg1IC94757
CVE: CVE-2013-4039
Published: 2013-08-28
Description: IBM WebSphere Extended Deployment Compute Grid 8.0 before 8.0.0.3 allows remote authenticated users to obtain sensitive information, and consequently bypass intended access restrictions on jobs, via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/96607; http://secunia.com/advisories/54651; http://www-01.ibm.com/support/docview.wss?uid=swg1PM84760
CVE: CVE-2013-1432
Published: 2013-08-28
Description: Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2013-2072
Published: 2013-08-28
Description: Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
CVSS Score: 7.4 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106718.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106721.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106778.html