deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4732
Published: 2013-06-30
Description: The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network.  NOTE: VU#662676 states "Monroe Electronics could not reproduce this finding.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf; http://www.kb.cert.org/vuls/id/662676; http://www.kb.cert.org/vuls/id/AAMN-98MU7H
CVE: CVE-2013-4733
Published: 2013-06-30
Description: The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf; http://www.kb.cert.org/vuls/id/662676; http://www.kb.cert.org/vuls/id/AAMN-98MU7H
CVE: CVE-2013-4734
Published: 2013-06-30
Description: dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf; http://www.kb.cert.org/vuls/id/662676; http://www.kb.cert.org/vuls/id/AAMN-98MU7H
CVE: CVE-2013-4735
Published: 2013-06-30
Description: The Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 have a default password for an administrative account, which makes it easier for remote attackers to obtain access via an IP network.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf; http://www.kb.cert.org/vuls/id/662676; http://www.kb.cert.org/vuls/id/AAMN-98MU7H
CVE: CVE-2013-3652
Published: 2013-06-30
Description: Cross-site scripting (XSS) vulnerability in data/class/pages/products/LC_Page_Products_List.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategory_id2 field, a different vulnerability than CVE-2013-3653.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN07192063/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000063; http://svn.ec-cube.net/open_trac/changeset/22862
CVE: CVE-2013-3653
Published: 2013-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN98665228/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000064; http://svn.ec-cube.net/open_trac/changeset/22861
CVE: CVE-2012-6144
Published: 2013-07-01
Description: SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/87115; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/; http://www.openwall.com/lists/oss-security/2013/06/19/4
CVE: CVE-2012-6145
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/87116; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/; http://www.openwall.com/lists/oss-security/2013/06/19/4
CVE: CVE-2012-6147
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/87113; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/; http://www.openwall.com/lists/oss-security/2013/06/19/4
CVE: CVE-2012-6148
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/87114; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/; https://exchange.xforce.ibmcloud.com/vulnerabilities/79968
CVE: CVE-2013-2158
Published: 2013-07-01
Description: Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93980; http://seclists.org/fulldisclosure/2013/Jun/23; http://secunia.com/advisories/53649
CVE: CVE-2013-3925
Published: 2013-07-01
Description: Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf; https://jira.atlassian.com/browse/CWD-3366; http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf
CVE: CVE-2013-3926
Published: 2013-07-01
Description: Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor."  NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.
CVSS Score: 7.5 (HIGH)
References: http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd; http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf; http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd
CVE: CVE-2013-4744
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/89132; http://typo3.org/extensions/repository/view/phpunit; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001/
CVE: CVE-2013-4745
Published: 2013-07-01
Description: SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90410; http://typo3.org/extensions/repository/view/myquizpoll; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE: CVE-2013-4746
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90409; http://typo3.org/extensions/repository/view/myquizpoll; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE: CVE-2013-4747
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the Accessible browse results for indexed search (accessible_is_browse_results) extension 1.2.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/93819; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-007/; http://www.securityfocus.com/bid/60297
CVE: CVE-2013-4748
Published: 2013-07-01
Description: SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/89134; http://typo3.org/extensions/repository/view/news; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001/
CVE: CVE-2013-4749
Published: 2013-07-01
Description: Cross-site scripting (XSS) vulnerability in the UserTask Center, Messaging (sys_messages) extension 1.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/; https://exchange.xforce.ibmcloud.com/vulnerabilities/81584; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/
CVE: CVE-2013-3581
Published: 2013-07-02
Description: ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax (1) wmxState or (2) netState request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/932044; http://www.kb.cert.org/vuls/id/932044
CVE: CVE-2013-2171
Published: 2013-07-02
Description: The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://svnweb.freebsd.org/base?view=revision&revision=251901; http://www.debian.org/security/2013/dsa-2714; http://www.freebsd.org/security/advisories/FreeBSD-SA-13:06.mmap.asc
CVE: CVE-2013-3395
Published: 2013-07-02
Description: Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devices, Email Security Appliance (ESA) devices, and Content Security Management Appliance (SMA) devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuh70263, CSCuh70323, and CSCuh26634.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395
CVE: CVE-2013-3399
Published: 2013-07-02
Description: Buffer overflow in an unspecified Android API on the Cisco Desktop Collaboration Experience DX650 allows attackers to execute arbitrary code via vectors that leverage incorrect memory allocation, aka Bug IDs CSCuf93957, CSCug22352, and CSCug22462.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3399; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3399
CVE: CVE-2013-3401
Published: 2013-07-02
Description: The SIP implementation in Cisco TelePresence TC Software allows remote attackers to trigger unintended use of NOTIFY messages via unspecified vectors, aka Bug ID CSCud96080.
CVSS Score: 4.3 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3401; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3401
CVE: CVE-2013-0455
Published: 2013-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2.4 and Sterling File Gateway allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC92888; http://www-01.ibm.com/support/docview.wss?uid=swg1IC92888
CVE: CVE-2013-2983
Published: 2013-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling File Gateway 2.2 and Sterling B2B Integrator allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2013-0468.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC91045; http://www-01.ibm.com/support/docview.wss?uid=swg1IC91045
CVE: CVE-2013-3003
Published: 2013-07-02
Description: Unspecified vulnerability in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 allows remote authenticated users to execute arbitrary commands via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21641655; https://exchange.xforce.ibmcloud.com/vulnerabilities/84129; http://www-01.ibm.com/support/docview.wss?uid=swg21641655
CVE: CVE-2012-4965
Published: 2013-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6569.  Reason: This candidate is a reservation duplicate of CVE-2012-6569.  Notes: All CVE users should reference CVE-2012-6569 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-4966
Published: 2013-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6570.  Reason: This candidate is a reservation duplicate of CVE-2012-6570.  Notes: All CVE users should reference CVE-2012-6570 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-4967
Published: 2013-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6571.  Reason: This candidate is a reservation duplicate of CVE-2012-6571.  Notes: All CVE users should reference CVE-2012-6571 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3726
Published: 2013-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-1636.  Reason: This candidate is a reservation duplicate of CVE-2013-1636.  Notes: All CVE users should reference CVE-2013-1636 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2343
Published: 2013-07-02
Description: Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1510.
CVSS Score: 10.0 (HIGH)
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03661318; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03661318
CVE: CVE-2013-3028
Published: 2013-07-02
Description: Multiple buffer overflows in mqm programs in IBM WebSphere MQ 7.0.x before 7.0.1.11, 7.1.x before 7.1.0.3, and 7.5.x before 7.5.0.2 on non-Windows platforms allow local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV43368; http://www-01.ibm.com/support/docview.wss?uid=swg21639001; https://exchange.xforce.ibmcloud.com/vulnerabilities/84564
CVE: CVE-2012-5766
Published: 2013-07-03
Description: Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL commands via vectors involving the RNVisibility page and unspecified screens, a different vulnerability than CVE-2013-0560.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC84082; http://www-01.ibm.com/support/docview.wss?uid=swg21627982; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2012-5936
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21627985; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/80401
CVE: CVE-2013-0456
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to hijack sessions via a modified cookie path.
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/80972; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0463
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81017; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0468
Published: 2013-07-03
Description: Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-2983.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81334; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0475
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81403; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0476
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81405; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0479
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass intended access restrictions via a crafted filename.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81547; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0481
Published: 2013-07-03
Description: The console in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to read stack traces by triggering (1) an error or (2) an exception.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21627986; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/81546
CVE: CVE-2013-0539
Published: 2013-07-03
Description: An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC92007; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/82916
CVE: CVE-2013-0558
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive information about application implementation via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC90483; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/83006
CVE: CVE-2013-0560
Published: 2013-07-03
Description: Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2012-5766.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/83012; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-0567
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0475.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC91151; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/83164
CVE: CVE-2013-0568
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0475, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/83165; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-2982
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to upload arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/83997; http://www-01.ibm.com/support/docview.wss?uid=swg21640830