deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0551
Published: 2013-06-21
Description: The Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to cause a denial of service (abend) via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192; http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115
CVE: CVE-2013-2960
Published: 2013-06-21
Description: Buffer overflow in KDSMAIN in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to cause a denial of service (segmentation fault) via a crafted http URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192; http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115
CVE: CVE-2013-2961
Published: 2013-06-21
Description: The internal web server in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to perform unspecified redirection of HTTP requests, and bypass the proxy-server configuration, via crafted HTTP traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192; http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115
CVE: CVE-2012-6572
Published: 2013-06-21
Description: Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/85422; http://secunia.com/advisories/50557; http://www.madirish.net/550
CVE: CVE-2013-0523
Published: 2013-06-21
Description: IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8 processing of the krypto parameter, and leverages unspecified browser access or traffic-log access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR46386; http://www.vsecurity.com/advisory/20130619-1.txt; http://www.vsecurity.com/resources/advisory/20130619-1/
CVE: CVE-2013-2110
Published: 2013-06-21
Description: Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to the quoted_printable_encode function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://support.apple.com/kb/HT5880; http://www.php.net/ChangeLog-5.php
CVE: CVE-2013-3250
Published: 2013-06-21
Description: Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53125; http://wordpress.org/plugins/wp-maintenance-mode/changelog/; http://secunia.com/advisories/53125
CVE: CVE-2013-3392
Published: 2013-06-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco WebEx Social allow remote attackers to hijack the authentication of arbitrary users via unspecified vectors, aka Bug IDs CSCuh10405 and CSCuh10355.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3392; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3392
CVE: CVE-2013-4613
Published: 2013-06-21
Description: The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE: the vendor has apparently responded by stating "for user convenience, the default setting does not require a password. However, if a user has a particular concern about third parties accessing the user's home printer, the default setting can be changed to add a password."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html; http://www.mattandreko.com/2013/06/canon-y-u-no-security.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html
CVE: CVE-2013-4614
Published: 2013-06-21
Description: English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphrase in cleartext, which allows physically proximate attackers to obtain sensitive information by reading the screen of an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html; http://www.mattandreko.com/2013/06/canon-y-u-no-security.html; https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/canon_wireless.rb
CVE: CVE-2013-4615
Published: 2013-06-21
Description: The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html.  NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html; http://www.mattandreko.com/2013/06/canon-y-u-no-security.html; https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb
CVE: CVE-2013-4635
Published: 2013-06-21
Description: Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00007.html
CVE: CVE-2013-4636
Published: 2013-06-21
Description: The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.php.net/ChangeLog-5.php; https://bugs.php.net/bug.php?id=64830; http://www.php.net/ChangeLog-5.php
CVE: CVE-2013-1906
Published: 2013-06-24
Description: Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/52768; https://drupal.org/node/1954508; https://drupal.org/node/1954592
CVE: CVE-2013-1972
Published: 2013-06-24
Description: Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create, modify, or delete files via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0237.html; http://osvdb.org/92533; https://drupal.org/node/1972082
CVE: CVE-2013-2036
Published: 2013-06-24
Description: Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "lists of files."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53228; https://drupal.org/node/1983356; https://drupal.org/node/1984212
CVE: CVE-2013-2129
Published: 2013-06-24
Description: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/93749; http://secunia.com/advisories/53184; http://www.securityfocus.com/bid/60218
CVE: CVE-2013-4604
Published: 2013-06-25
Description: Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.fortiguard.com/advisory/FGA-2013-20/; http://www.fortiguard.com/advisory/FGA-2013-20/
CVE: CVE-2013-4669
Published: 2013-06-25
Description: FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-255, CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0001.html; http://objectif-securite.ch/forticlient_bulletin.php; http://www.fortiguard.com/advisory/Potential-Man-In-The-Middle-Vulnerability-in-FortiClient-VPN/
CVE: CVE-2012-6573
Published: 2013-06-25
Description: Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/85062; http://seclists.org/fulldisclosure/2013/Jun/212; http://secunia.com/advisories/50443
CVE: CVE-2013-1971
Published: 2013-06-25
Description: Cross-site scripting (XSS) vulnerability in the MP3 Player module for Drupal 6.x allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the file name of a MP3 file.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/59276; https://drupal.org/node/1972804; https://exchange.xforce.ibmcloud.com/vulnerabilities/83649
CVE: CVE-2013-2177
Published: 2013-06-25
Description: Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity bundle label.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/94234; http://seclists.org/fulldisclosure/2013/Jun/94; https://drupal.org/node/2017639
CVE: CVE-2013-4680
Published: 2013-06-25
Description: Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/93818; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-007/; http://www.securityfocus.com/bid/60298
CVE: CVE-2013-4681
Published: 2013-06-25
Description: SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/53280; http://typo3.org/extensions/repository/view/sofortueberweisung2commerce; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/
CVE: CVE-2013-4682
Published: 2013-06-25
Description: SQL injection vulnerability in the Multishop extension before 2.0.39 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/53441; http://typo3.org/extensions/repository/view/multishop; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-009-1/
CVE: CVE-2013-4683
Published: 2013-06-25
Description: SQL injection vulnerability in the meta_feedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/93806; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-007/; https://exchange.xforce.ibmcloud.com/vulnerabilities/84661
CVE: CVE-2013-1682
Published: 2013-06-26
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1683
Published: 2013-06-26
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-49.html
CVE: CVE-2013-1684
Published: 2013-06-26
Description: Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1685
Published: 2013-06-26
Description: Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1686
Published: 2013-06-26
Description: Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1687
Published: 2013-06-26
Description: The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1688
Published: 2013-06-26
Description: The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-52.html
CVE: CVE-2013-1690
Published: 2013-06-26
Description: Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1692
Published: 2013-06-26
Description: Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1693
Published: 2013-06-26
Description: The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1694
Published: 2013-06-26
Description: The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1695
Published: 2013-06-26
Description: Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-57.html
CVE: CVE-2013-1696
Published: 2013-06-26
Description: Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-58.html
CVE: CVE-2013-1697
Published: 2013-06-26
Description: The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
CVE: CVE-2013-1698
Published: 2013-06-26
Description: The getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a top-level document instead of the URL of a specific page, which makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-60.html; http://www.ubuntu.com/usn/USN-1890-1