deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5562
Published: 2013-11-06
Description: The ITM web server in Cisco Prime Central for Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (temporary HTTP service outage) via a flood of TCP packets, aka Bug ID CSCuh36313.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5562; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5562
CVE: CVE-2013-5563
Published: 2013-11-06
Description: Cross-site scripting (XSS) vulnerability in Query/NewQueryResult.jsp in Cisco Security Monitoring, Analysis and Response System (CS-MARS) allows remote attackers to inject arbitrary web script or HTML via the isnowLatency parameter, aka Bug ID CSCul16173.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0016.html; http://research.smartnetsecurity.net/advisory/-smt-sa-2013-02-cisco-mars-cross-site-scripting-vulnerability; http://archives.neohapsis.com/archives/bugtraq/2013-11/0016.html
CVE: CVE-2013-4050
Published: 2013-11-08
Description: Cross-site request forgery (CSRF) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652988; https://exchange.xforce.ibmcloud.com/vulnerabilities/86433; http://www-01.ibm.com/support/docview.wss?uid=swg21652988
CVE: CVE-2013-4051
Published: 2013-11-08
Description: Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-4055.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652988; https://exchange.xforce.ibmcloud.com/vulnerabilities/86503; http://www-01.ibm.com/support/docview.wss?uid=swg21652988
CVE: CVE-2013-4055
Published: 2013-11-08
Description: Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-4051.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652988; https://exchange.xforce.ibmcloud.com/vulnerabilities/86544; http://www-01.ibm.com/support/docview.wss?uid=swg21652988
CVE: CVE-2013-4508
Published: 2013-11-08
Description: lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt; http://jvn.jp/en/jp/JVN37417423/index.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
CVE: CVE-2013-4716
Published: 2013-11-08
Description: Cross-site scripting (XSS) vulnerability in Tattyan HP TOWN 5_9_3 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12513975/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000101; http://www2s.biglobe.ne.jp/~tatsuji/souko/annnai.html
CVE: CVE-2013-4987
Published: 2013-11-08
Description: PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www.coresecurity.com/advisories/pinapp-mail-secure-access-control-failure; http://www.coresecurity.com/advisories/pinapp-mail-secure-access-control-failure
CVE: CVE-2013-5553
Published: 2013-11-08
Description: Multiple memory leaks in Cisco IOS 15.1 before 15.1(4)M7 allow remote attackers to cause a denial of service (memory consumption or device reload) by sending a crafted SIP message over (1) IPv4 or (2) IPv6, aka Bug IDs CSCuc42558 and CSCug25383.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-sip; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-sip
CVE: CVE-2013-5554
Published: 2013-11-08
Description: Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-waasm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-waasm
CVE: CVE-2013-5558
Published: 2013-11-08
Description: The WIL-A module in Cisco TelePresence VX Clinical Assistant 1.2 before 1.21 changes the admin password to an empty password upon a reboot, which makes it easier for remote attackers to obtain access via the administrative interface, aka Bug ID CSCuj17238.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-tvxca; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131106-tvxca
CVE: CVE-2013-5565
Published: 2013-11-08
Description: The OSPFv3 functionality in Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (process crash) via a malformed LSA Type-1 packet, aka Bug ID CSCuj82176.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5565; http://tools.cisco.com/security/center/viewAlert.x?alertId=31675; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5565
CVE: CVE-2013-5566
Published: 2013-11-08
Description: Cisco NX-OS 5.0 and earlier on MDS 9000 devices allows remote attackers to cause a denial of service (supervisor CPU consumption) via Authentication Header (AH) authentication in a Virtual Router Redundancy Protocol (VRRP) frame, aka Bug ID CSCte27874.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5566; http://tools.cisco.com/security/center/viewAlert.x?alertId=31663; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5566
CVE: CVE-2013-6230
Published: 2013-11-08
Description: The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask 255.255.255.255, which allows remote attackers to bypass intended IP address restrictions by leveraging misinterpretation of this netmask as a 0.0.0.0 netmask.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.518391; https://kb.isc.org/article/AA-01062; https://kb.isc.org/article/AA-01063
CVE: CVE-2013-3986
Published: 2013-11-08
Description: IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654041; https://exchange.xforce.ibmcloud.com/vulnerabilities/84969; http://www-01.ibm.com/support/docview.wss?uid=swg21654041
CVE: CVE-2013-4548
Published: 2013-11-08
Description: The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00017.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2836&w=2; http://openwall.com/lists/oss-security/2013/11/08/3
CVE: CVE-2013-0537
Published: 2013-11-09
Description: The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654355; https://exchange.xforce.ibmcloud.com/vulnerabilities/84840; http://www-01.ibm.com/support/docview.wss?uid=swg21654355
CVE: CVE-2013-3044
Published: 2013-11-09
Description: The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages, by leveraging meeting-attendance privileges.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654355; https://exchange.xforce.ibmcloud.com/vulnerabilities/84815; http://www-01.ibm.com/support/docview.wss?uid=swg21654355
CVE: CVE-2013-3045
Published: 2013-11-09
Description: The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654355; https://exchange.xforce.ibmcloud.com/vulnerabilities/84816; http://www-01.ibm.com/support/docview.wss?uid=swg21654355
CVE: CVE-2013-3985
Published: 2013-11-09
Description: The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by leveraging a weak setting of the Domain variable.
CVSS Score: 2.9 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654355; https://exchange.xforce.ibmcloud.com/vulnerabilities/84968; http://www-01.ibm.com/support/docview.wss?uid=swg21654355
CVE: CVE-2013-2239
Published: 2013-11-12
Description: vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2013/07/04/9; http://wiki.openvz.org/Download/kernel/rhel6-testing/042stab080.2; http://www.debian.org/security/2013/dsa-2766
CVE: CVE-2013-3918
Published: 2013-11-12
Description: The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx; http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/; http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html
CVE: CVE-2013-4511
Published: 2013-11-12
Description: Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7314e613d5ff9f0934f7a0f74ed7973b903315d1; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
CVE: CVE-2013-4512
Published: 2013-11-12
Description: Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=201f99f170df14ba52ea4c[PII_REDACTED]2b7a623b; http://www.openwall.com/lists/oss-security/2013/11/04/22; http://www.securityfocus.com/bid/63510
CVE: CVE-2013-4513
Published: 2013-11-12
Description: Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c2c65cd2e14ada6de44cb527e7f1990bede24e15; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://www.openwall.com/lists/oss-security/2013/11/04/22
CVE: CVE-2013-4514
Published: 2013-11-12
Description: Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b5e2f339865fb443107e5b10603e53bbc92dc054; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
CVE: CVE-2013-4515
Published: 2013-11-12
Description: The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d1e72250c847fa96498ec029891de4dc638a5ba; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
CVE: CVE-2013-4516
Published: 2013-11-12
Description: The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a8b33654b1e3b0c74d4a1fed041c9aae50b3c427; http://www.openwall.com/lists/oss-security/2013/11/04/22; http://www.ubuntu.com/usn/USN-2069-1
CVE: CVE-2013-4740
Published: 2013-11-12
Description: goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, relies on user-space length values for kernel-memory copies of procfs file content, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2013/11/08/1; https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05; https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler
CVE: CVE-2013-6122
Published: 2013-11-12
Description: goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly synchronize updates to a global variable, which allows local users to bypass intended access restrictions or cause a denial of service (memory corruption) via crafted arguments to the procfs write handler.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/11/08/1; https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05; https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler
CVE: CVE-2013-6763
Published: 2013-11-12
Description: The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7314e613d5ff9f0934f7a0f74ed7973b903315d1; http://www.openwall.com/lists/oss-security/2013/11/04/22; http://www.ubuntu.com/usn/USN-2064-1
CVE: CVE-2013-5726
Published: 2013-11-12
Description: Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.binaryfactory.ca/2013/11/cve-2013-5726-tweetbot-for-ios-and-mac-user-disclosureprivacy-issue/; http://osvdb.org/99256; http://seclists.org/fulldisclosure/2013/Nov/9
CVE: CVE-2013-0082
Published: 2013-11-13
Description: Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "WPD File Format Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-091; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19178
CVE: CVE-2013-1324
Published: 2013-11-13
Description: Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Stack Buffer Overwrite Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-091; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19162
CVE: CVE-2013-1325
Published: 2013-11-13
Description: Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Heap Overwrite Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-091; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19321
CVE: CVE-2013-2653
Published: 2013-11-13
Description: security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2013/Aug/12; https://github.com/chillu/silverstripe-framework/commit/3e88c98ca513880e2b43ed7f27ade17fef5d9170; http://seclists.org/bugtraq/2013/Aug/12
CVE: CVE-2013-3869
Published: 2013-11-13
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to cause a denial of service (daemon hang) via a web-service request containing a crafted X.509 certificate that is not properly handled during validation, aka "Digital Signatures Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-095; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19112
CVE: CVE-2013-3887
Published: 2013-11-13
Description: The Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows local users to obtain sensitive information from kernel memory by leveraging improper copy operations, aka "Ancillary Function Driver Information Disclosure Vulnerability."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-093; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18805
CVE: CVE-2013-3898
Published: 2013-11-13
Description: Microsoft Windows 8 and Windows Server 2012, when Hyper-V is used, does not ensure memory-address validity, which allows guest OS users to execute arbitrary code in all guest OS instances, and allows guest OS users to cause a denial of service (host OS crash), via a guest-to-host hypercall with a crafted function parameter, aka "Address Corruption Vulnerability."
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-092; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18851
CVE: CVE-2013-3905
Published: 2013-11-13
Description: Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka "S/MIME AIA Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-094; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19239
CVE: CVE-2013-3908
Published: 2013-11-13
Description: Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information from any visited document via a crafted web page that is not properly handled during a print-preview action, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18706