deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3009
Published: 2013-07-23
Description: The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
CVE: CVE-2013-3010
Published: 2013-07-23
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 6.0.1 before 6.0.1 SR6 and 7 before 7 SR5 allows remote attackers to affect confidentiality, availability, and integrity via unknown vectors, a different vulnerability than CVE-2013-3007.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html; http://rhn.redhat.com/errata/RHSA-2013-1060.html
CVE: CVE-2013-3011
Published: 2013-07-23
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect confidentiality, availability, and integrity via unknown vectors, a different vulnerability than CVE-2013-3009 and CVE-2013-3012.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
CVE: CVE-2013-3012
Published: 2013-07-23
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect confidentiality, availability, and integrity via unknown vectors, a different vulnerability than CVE-2013-3009 and CVE-2013-3011.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
CVE: CVE-2013-4002
Published: 2013-07-23
Description: XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
CVSS Score: 7.1 (HIGH)
References: http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
CVE: CVE-2013-2249
Published: 2013-07-23
Description: mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698; http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/session/mod_session_dbd.c?r1=1409170&r2=1488158&diff_format=h; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-2249
CVE: CVE-2013-3439
Published: 2013-07-23
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified HTTP header field, aka Bug ID CSCud80182.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95585; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3439; http://tools.cisco.com/security/center/viewAlert.x?alertId=30174
CVE: CVE-2013-3440
Published: 2013-07-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML, and obtain improperly secured cookies, via unspecified vectors, aka Bug ID CSCud80186.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95584; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3440; http://tools.cisco.com/security/center/viewAlert.x?alertId=30175
CVE: CVE-2012-4735
Published: 2013-07-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, CVE-2012-6581.  Reason: This candidate is a duplicate of CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, and CVE-2012-6581.  Notes: All CVE users should reference one or more of CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, and CVE-2012-6581 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-6578
Published: 2013-07-24
Description: Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which might allow remote attackers to spoof messages by leveraging the lack of authentication semantics.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html; http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html
CVE: CVE-2012-6579
Published: 2013-07-24
Description: Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service (loss of e-mail readability), via an e-mail message to a queue's address.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html; http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html
CVE: CVE-2012-6580
Published: 2013-07-24
Description: Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might make it easier for remote attackers to spoof details of a message's origin or interfere with encryption-policy auditing via an e-mail message to a queue's address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html; http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html
CVE: CVE-2012-6581
Published: 2013-07-24
Description: Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html; http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html
CVE: CVE-2013-3438
Published: 2013-07-24
Description: The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restrictions and read unspecified web pages via crafted parameters, aka Bug ID CSCuh86385.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/95583; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3438; http://tools.cisco.com/security/center/viewAlert.x?alertId=30186
CVE: CVE-2013-3979
Published: 2013-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/54286; http://www-01.ibm.com/support/docview.wss?uid=swg21643067; http://www.securityfocus.com/bid/61419
CVE: CVE-2013-3999
Published: 2013-07-25
Description: Cross-site scripting (XSS) vulnerability in IBM Social Media Analytics 1.2 before FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21644427; http://www-01.ibm.com/support/docview.wss?uid=swg24034591; https://exchange.xforce.ibmcloud.com/vulnerabilities/85253
CVE: CVE-2013-3414
Published: 2013-07-25
Description: Cross-site scripting (XSS) vulnerability in the WebVPN portal login page on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCug83080.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95660; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3414; http://tools.cisco.com/security/center/viewAlert.x?alertId=30214
CVE: CVE-2013-3429
Published: 2013-07-25
Description: Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system files via a crafted URL, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv37163.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsm; http://www.securityfocus.com/bid/61430; http://www.securitytracker.com/id/1028827
CVE: CVE-2013-3430
Published: 2013-07-25
Description: Cisco Video Surveillance Manager (VSM) before 7.0.0 allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv37288.
CVSS Score: 9.0 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsm; http://www.securityfocus.com/bid/61432; http://www.securitytracker.com/id/1028827
CVE: CVE-2013-3431
Published: 2013-07-25
Description: Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv40169.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsm; http://www.securityfocus.com/bid/61431; http://www.securitytracker.com/id/1028827
CVE: CVE-2013-4015
Published: 2013-07-26
Description: Microsoft Internet Explorer 6 through 10 allows local users to bypass the elevation policy check in the (1) Protected Mode or (2) Enhanced Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://exchange.xforce.ibmcloud.com/vulnerabilities/85762; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055
CVE: CVE-2013-4937
Published: 2013-07-26
Description: Multiple unspecified vulnerabilities in the AiCloud feature on the ASUS RT-AC66U, RT-N66U, RT-N65U, RT-N14U, RT-N16, RT-N56U, and DSL-N55U with firmware before 3.0.4.372 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://reviews.cnet.com/8301-3132_7-57594003-98; http://twitter.com/ASUSUSA/statuses/[PII_REDACTED]92509440; http://reviews.cnet.com/8301-3132_7-57594003-98
CVE: CVE-2013-3300
Published: 2013-07-29
Description: The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://blog.addepar.com/2013/07/an-atypical-web-vulnerability.html; https://github.com/lift/framework/commit/099d9c86cf6d81f4953957add478ab699946e601; http://blog.addepar.com/2013/07/an-atypical-web-vulnerability.html
CVE: CVE-2013-3445
Published: 2013-07-29
Description: The firewall subsystem in Cisco Identity Services Engine has an incorrect rule for open ports, which allows remote attackers to cause a denial of service (CPU consumption or process crash) via a flood of malformed IP packets, aka Bug ID CSCug94572.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/95659; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3445; http://tools.cisco.com/security/center/viewAlert.x?alertId=30217
CVE: CVE-2013-4802
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in HP Application Lifecycle Management (ALM) Quality Center before 11.51 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka ZDI-CAN-1565.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95646; http://secunia.com/advisories/53950; http://www.securityfocus.com/bid/61450
CVE: CVE-2013-2368
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to cause a denial of service via unknown vectors, aka ZDI-CAN-1669.
CVSS Score: 5.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772
CVE: CVE-2013-2369
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1670.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772
CVE: CVE-2013-2370
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772
CVE: CVE-2013-4797
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1690.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/95641; http://www.securityfocus.com/bid/61444; https://exchange.xforce.ibmcloud.com/vulnerabilities/85957
CVE: CVE-2013-4798
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/95642; http://www.securityfocus.com/bid/61443; https://exchange.xforce.ibmcloud.com/vulnerabilities/85958
CVE: CVE-2013-4799
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1734.
CVSS Score: 7.6 (HIGH)
References: http://osvdb.org/95643; http://www.securityfocus.com/bid/61442; https://exchange.xforce.ibmcloud.com/vulnerabilities/85959
CVE: CVE-2013-4800
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/95644; http://packetstormsecurity.com/files/123533; http://www.securityfocus.com/bid/61446
CVE: CVE-2013-4801
Published: 2013-07-29
Description: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1736.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/95645; http://www.securityfocus.com/bid/61445; https://exchange.xforce.ibmcloud.com/vulnerabilities/85961
CVE: CVE-2013-2242
Published: 2013-07-29
Description: mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39628; https://moodle.org/mod/forum/discuss.php?d=232498; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39628
CVE: CVE-2013-2243
Published: 2013-07-29
Description: mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39546; https://moodle.org/mod/forum/discuss.php?d=232500; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39546
CVE: CVE-2013-2244
Published: 2013-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in lib/conditionlib.php in Moodle 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the conditional access rule value of a user field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37516; https://moodle.org/mod/forum/discuss.php?d=232501; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37516
CVE: CVE-2013-2245
Published: 2013-07-29
Description: rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37818; https://moodle.org/mod/forum/discuss.php?d=232502; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37818
CVE: CVE-2013-2246
Published: 2013-07-29
Description: mod/feedback/lib.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/feedback:view capability before displaying recent feedback, which allows remote authenticated users to obtain sensitive information via a request for all course feedback that has occurred since a specified time.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39570; https://moodle.org/mod/forum/discuss.php?d=232503; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39570
CVE: CVE-2013-4938
Published: 2013-07-29
Description: The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly support the sendname, sendemailaddr, and acceptgrades settings, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40308; https://moodle.org/mod/forum/discuss.php?d=232497; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40308
CVE: CVE-2013-4939
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678; http://yuilibrary.com/support/20130515-vulnerability/; https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c%40%3Cissues.zookeeper.apache.org%3E
CVE: CVE-2013-4940
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.  NOTE: this vulnerability exists because of a CVE-2013-4939 regression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678; http://yuilibrary.com/support/20130515-vulnerability/; https://moodle.org/mod/forum/discuss.php?d=232496
CVE: CVE-2013-4941
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678; http://yuilibrary.com/support/20130515-vulnerability/; https://moodle.org/mod/forum/discuss.php?d=232496
CVE: CVE-2013-4942
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678; http://yuilibrary.com/support/20130515-vulnerability/; https://moodle.org/mod/forum/discuss.php?d=232496
CVE: CVE-2013-4854
Published: 2013-07-29
Description: The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://linux.oracle.com/errata/ELSA-2014-1244