deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-7129
Published: 2013-12-17
Description: Cross-site scripting (XSS) vulnerability in ThemeBeans Blooog theme 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the jQuery parameter to assets/js/jplayer.swf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124240; http://www.securityfocus.com/bid/64046; https://exchange.xforce.ibmcloud.com/vulnerabilities/89356
CVE: CVE-2013-5195
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; https://support.apple.com/kb/HT6537
CVE: CVE-2013-5196
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5197
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5198
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5199
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5225
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5227
Published: 2013-12-18
Description: Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
CVE: CVE-2013-5228
Published: 2013-12-18
Description: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-12/0087.html; http://support.apple.com/kb/HT6162
CVE: CVE-2013-5397
Published: 2013-12-18
Description: Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9, 6.6 before devfix5, 6.6.0.1 before devfix2, and 6.6.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2013-5398.
CVSS Score: 3.3 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654471; https://exchange.xforce.ibmcloud.com/vulnerabilities/87293; http://www-01.ibm.com/support/docview.wss?uid=swg21654471
CVE: CVE-2013-5398
Published: 2013-12-18
Description: Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9, 6.6 before devfix5, 6.6.0.1 before devfix2, and 6.6.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2013-5397.
CVSS Score: 3.3 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21654471; https://exchange.xforce.ibmcloud.com/vulnerabilities/87294; http://www-01.ibm.com/support/docview.wss?uid=swg21654471
CVE: CVE-2013-5402
Published: 2013-12-18
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities 7.1.x through 7.1.1.12, 7.1.2, 7.5 before 7.5.0.3 IFIX014, and 7.5.0.5 before IFIX003; SmartCloud Control Desk (SCCD) 7.5 before 7.5.0.3 IFIX014 and 7.5.0.5 before IFIX003; and Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.1.x through 7.1.1.12, 7.1.2, and 7.2.x through 7.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV49268; http://www-01.ibm.com/support/docview.wss?uid=swg21660032; http://www.securityfocus.com/bid/64333
CVE: CVE-2013-5415
Published: 2013-12-18
Description: Buffer overflow in IBM Rational ClearCase through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657982; https://exchange.xforce.ibmcloud.com/vulnerabilities/87477; http://www-01.ibm.com/support/docview.wss?uid=swg21657982
CVE: CVE-2013-5416
Published: 2013-12-18
Description: Unspecified vulnerability in IBM Rational ClearCase through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657982; https://exchange.xforce.ibmcloud.com/vulnerabilities/87478; http://www-01.ibm.com/support/docview.wss?uid=swg21657982
CVE: CVE-2013-5440
Published: 2013-12-18
Description: IBM InfoSphere Information Server 8.0, 8.1, 8.5, 8.7, and 9.1 allows local users to obtain sensitive information in opportunistic circumstances by leveraging the presence of file content after a failed installation.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR48095; http://www-01.ibm.com/support/docview.wss?uid=swg21659957; https://exchange.xforce.ibmcloud.com/vulnerabilities/87816
CVE: CVE-2013-5466
Published: 2013-12-18
Description: The XSLT library in IBM DB2 and DB2 Connect 9.5 through 10.5, and the DB2 pureScale Feature 9.8 for Enterprise Server Edition, allows remote authenticated users to cause a denial of service via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC97402; http://www-01.ibm.com/support/docview.wss?uid=swg1IC97470; http://www-01.ibm.com/support/docview.wss?uid=swg1IC97471
CVE: CVE-2013-6701
Published: 2013-12-18
Description: The tNetTaskLimit process on the Transport Node Controller (TNC) on Cisco ONS 15454 devices with software 9.6 and earlier does not properly prioritize health pings, which allows remote attackers to cause a denial of service (watchdog timeout and TNC reset) via a flood of network traffic, aka Bug ID CSCud97155.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6701; http://tools.cisco.com/security/center/viewAlert.x?alertId=32200; http://www.securitytracker.com/id/1029512
CVE: CVE-2013-4775
Published: 2013-12-19
Description: NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS752TPS, GS728TPS, GS728TS, and GS725TS with firmware 5.3.0.17; and GS752TXS and GS728TXS with firmware 6.1.0.12 allows remote attackers to read encrypted administrator credentials and other startup configurations via a direct request to filesystem/startup-config.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.encripto.no/forskning/whitepapers/Netgear_prosafe_advisory_aug_2013.pdf; http://www.encripto.no/forskning/whitepapers/Netgear_prosafe_advisory_aug_2013.pdf
CVE: CVE-2013-4776
Published: 2013-12-19
Description: NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows remote attackers to cause a denial of service (reboot or crash) via a crafted HTTP request to filesystem/.
CVSS Score: 7.8 (HIGH)
References: http://www.encripto.no/forskning/whitepapers/Netgear_prosafe_advisory_aug_2013.pdf; http://www.encripto.no/forskning/whitepapers/Netgear_prosafe_advisory_aug_2013.pdf
CVE: CVE-2013-5946
Published: 2013-12-19
Description: The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "Ping or Trace an IP Address" or (2) "Perform a DNS Lookup" section.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf
CVE: CVE-2013-6824
Published: 2013-12-19
Description: Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://security.gentoo.org/glsa/glsa-201401-26.xml; http://www.zabbix.com/rn1.8.19rc1.php; http://www.zabbix.com/rn2.0.10rc1.php
CVE: CVE-2013-6836
Published: 2013-12-19
Description: Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-02/msg00018.html; http://secunia.com/advisories/56678; http://www.securityfocus.com/bid/64459
CVE: CVE-2013-6837
Published: 2013-12-19
Description: Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://themeforest.net/forums/thread/security-vulnerability-affecting-prettyphoto-jquery-script/181180; http://themeforest.net/item/udesign-responsive-wordpress-theme/253220
CVE: CVE-2013-7004
Published: 2013-12-19
Description: D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 have a hardcoded account of username gkJ9232xXyruTRmY, which makes it easier for remote attackers to obtain access by leveraging knowledge of the username.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf
CVE: CVE-2013-7005
Published: 2013-12-19
Description: D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext, which allows local users to obtain sensitive information by reading the Users[#]["Password"] fields in /tmp/teamf1.cfg.ascii.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/30061; http://www.exploit-db.com/exploits/30061
CVE: CVE-2013-7067
Published: 2013-12-19
Description: The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/100611; http://www.securityfocus.com/bid/64134; https://drupal.org/node/2149743
CVE: CVE-2013-7086
Published: 2013-12-19
Description: The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0079.html; http://osvdb.org/100920; http://packetstormsecurity.com/files/124421
CVE: CVE-2013-4403
Published: 2013-12-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-4404.  Reason: This candidate is a reservation duplicate of CVE-2013-4404.  Notes: All CVE users should reference CVE-2013-4404 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4418
Published: 2013-12-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-5422
Published: 2013-12-19
Description: The Web Client in IBM Rational ClearQuest 7.1 through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2, when a multi-database dataset exists, allows remote attackers to read database names via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM97698; http://www-01.ibm.com/support/docview.wss?uid=swg21660036; https://exchange.xforce.ibmcloud.com/vulnerabilities/87484
CVE: CVE-2013-5426
Published: 2013-12-19
Description: Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 IF11 allows remote authenticated users to hijack web sessions via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21660082; https://exchange.xforce.ibmcloud.com/vulnerabilities/87535; http://www-01.ibm.com/support/docview.wss?uid=swg21660082
CVE: CVE-2013-5452
Published: 2013-12-19
Description: IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PJ40949; http://www-01.ibm.com/support/docview.wss?uid=swg21660343; http://www-304.ibm.com/support/docview.wss?uid=swg21963014
CVE: CVE-2013-5462
Published: 2013-12-19
Description: IBM/ECMClient/configure/explodedformat/navigator/header.jsp in IBM Content Navigator 2.0.0, 2.0.1 before 2.0.1.2-ICN-FP002, and 2.0.2 before 2.0.2.1-ICN-FP001 allows remote attackers to conduct clickjacking attacks via vectors involving FRAME elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21660223; http://www.securitytracker.com/id/1037704; https://exchange.xforce.ibmcloud.com/vulnerabilities/88358
CVE: CVE-2013-6178
Published: 2013-12-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0120.html; http://www.securitytracker.com/id/1029523; http://archives.neohapsis.com/archives/bugtraq/2013-12/0120.html
CVE: CVE-2013-6717
Published: 2013-12-19
Description: The OLAP query engine in IBM DB2 and DB2 Connect 9.7 through FP9, 9.8 through FP5, 10.1 through FP3, and 10.5 through FP2, and the DB2 pureScale Feature 9.8 for Enterprise Server Edition, allows remote authenticated users to cause a denial of service (database outage and deactivation) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/56451; http://www-01.ibm.com/support/docview.wss?uid=swg1IC95641; http://www-01.ibm.com/support/docview.wss?uid=swg1IC97737
CVE: CVE-2013-6877
Published: 2013-12-19
Description: Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an RMP file, a different vulnerability than CVE-2013-7260.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0104.html; http://packetstormsecurity.com/files/124535; http://service.real.com/realplayer/security/12202013_player/en/
CVE: CVE-2013-6976
Published: 2013-12-19
Description: Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101097; http://packetstormsecurity.com/files/124449/Cisco-EPC3925-Cross-Site-Request-Forgery.html; http://www.exploit-db.com/exploits/30362/
CVE: CVE-2013-7100
Published: 2013-12-19
Description: Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0089.html; http://downloads.asterisk.org/pub/security/AST-2013-006.html; http://osvdb.org/101100
CVE: CVE-2013-7112
Published: 2013-12-19
Description: The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sip.c?r1=51738&r2=51737&pathrev=51738; http://anonsvn.wireshark.org/viewvc?view=revision&revision=51738; http://lists.opensuse.org/opensuse-updates/2014-01/msg00007.html
CVE: CVE-2013-7113
Published: 2013-12-19
Description: epan/dissectors/packet-bssgp.c in the BSSGP dissector in Wireshark 1.10.x before 1.10.4 incorrectly relies on a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk-1.10/epan/dissectors/packet-bssgp.c?r1=53803&r2=53802&pathrev=53803; http://anonsvn.wireshark.org/viewvc?view=revision&revision=53803; http://lists.opensuse.org/opensuse-updates/2014-01/msg00007.html
CVE: CVE-2013-7114
Published: 2013-12-19
Description: Multiple buffer overflows in the create_ntlmssp_v2_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 allow remote attackers to cause a denial of service (application crash) via a long domain name in a packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ntlmssp.c?r1=53626&r2=53625&pathrev=53626; http://anonsvn.wireshark.org/viewvc?view=revision&revision=53626; http://lists.opensuse.org/opensuse-updates/2014-01/msg00007.html
CVE: CVE-2013-7136
Published: 2013-12-19
Description: The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK passphrases, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://www.exploit-db.com/exploits/30358/; http://www.planitcomputing.ie/upc-wifi-attack.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/90133
CVE: CVE-2013-4576
Published: 2013-12-20
Description: GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html; http://osvdb.org/101170; http://rhn.redhat.com/errata/RHSA-2014-0016.html