deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4835
Published: 2013-11-04
Description: The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.
CVSS Score: 7.5 (HIGH)
References: http://www.exploit-db.com/exploits/30473; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435; https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435
CVE: CVE-2013-4836
Published: 2013-11-04
Description: Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management (ALM) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969436; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969436
CVE: CVE-2013-4837
Published: 2013-11-04
Description: Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437
CVE: CVE-2013-4838
Published: 2013-11-04
Description: Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1850.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437
CVE: CVE-2013-4839
Published: 2013-11-04
Description: Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, aka ZDI-CAN-1851.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437
CVE: CVE-2013-5559
Published: 2013-11-04
Description: Buffer overflow in the Active Template Library (ATL) framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobility Client 2.x allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document, aka Bug ID CSCuj58139.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5559; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5559
CVE: CVE-2013-5561
Published: 2013-11-04
Description: The Safe Search enforcement feature in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security Software does not properly perform filtering, which allows remote attackers to bypass intended policy restrictions via unspecified vectors, aka Bug ID CSCui94622.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5561; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5561
CVE: CVE-2013-5564
Published: 2013-11-04
Description: The Java process in the Impact server in Cisco Prime Central for Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (process crash) via a flood of TCP packets, aka Bug ID CSCug57345.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5564; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5564
CVE: CVE-2013-6336
Published: 2013-11-04
Description: The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ieee802154.c?r1=52036&r2=52035&pathrev=52036; http://anonsvn.wireshark.org/viewvc?view=revision&revision=52036; http://lists.opensuse.org/opensuse-updates/2013-11/msg00026.html
CVE: CVE-2013-6337
Published: 2013-11-04
Description: Unspecified vulnerability in the NBAP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00026.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00027.html; http://rhn.redhat.com/errata/RHSA-2014-0342.html
CVE: CVE-2013-6338
Published: 2013-11-04
Description: The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sip.c?r1=52354&r2=52353&pathrev=52354; http://anonsvn.wireshark.org/viewvc?view=revision&revision=52354; http://lists.opensuse.org/opensuse-updates/2013-11/msg00026.html
CVE: CVE-2013-6339
Published: 2013-11-04
Description: The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (loop) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-openwire.c?r1=52458&r2=52457&pathrev=52458; http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-openwire.c?r1=52463&r2=52462&pathrev=52463; http://anonsvn.wireshark.org/viewvc?view=revision&revision=52458
CVE: CVE-2013-6340
Published: 2013-11-04
Description: epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly determine the amount of remaining data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-tcp.c?r1=52570&r2=52569&pathrev=52570; http://anonsvn.wireshark.org/viewvc?view=revision&revision=52570; http://lists.opensuse.org/opensuse-updates/2013-11/msg00026.html
CVE: CVE-2013-6366
Published: 2013-11-04
Description: The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/28962/; http://www.exploit-db.com/exploits/28962/
CVE: CVE-2011-5267
Published: 2013-11-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.01 and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter.  NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.autosectools.com/Advisories/WikiWig.5.01_Persistent-Reflected.Cross-site.Scripting_139.html; http://www.exploit-db.com/exploits/16988; http://www.openwall.com/lists/oss-security/2013/09/01/1
CVE: CVE-2013-4435
Published: 2013-11-05
Description: Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://www.openwall.com/lists/oss-security/2013/10/18/3; http://docs.saltstack.com/topics/releases/0.17.1.html
CVE: CVE-2013-4436
Published: 2013-11-05
Description: The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://www.openwall.com/lists/oss-security/2013/10/18/3; http://docs.saltstack.com/topics/releases/0.17.1.html
CVE: CVE-2013-4437
Published: 2013-11-05
Description: Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
CVSS Score: 10.0 (HIGH)
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://www.openwall.com/lists/oss-security/2013/10/18/3; http://docs.saltstack.com/topics/releases/0.17.1.html
CVE: CVE-2013-4438
Published: 2013-11-05
Description: Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.  NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://www.openwall.com/lists/oss-security/2013/10/18/3; http://docs.saltstack.com/topics/releases/0.17.1.html
CVE: CVE-2013-4439
Published: 2013-11-05
Description: Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://www.openwall.com/lists/oss-security/2013/10/18/3; https://github.com/saltstack/salt/pull/7356
CVE: CVE-2013-5670
Published: 2013-11-05
Description: Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.s9y.org/archives/250-Serendipity-1.7.3-released.html; http://www.opensyscom.fr/Actualites/serendipity-xss-vulnerability.html; http://www.openwall.com/lists/oss-security/2013/09/01/1
CVE: CVE-2013-6077
Published: 2013-11-05
Description: Citrix XenDesktop 7.0, when upgraded from XenDesktop 5.x, does not properly enforce policy rule permissions, which allows remote attackers to bypass intended restrictions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/98890; http://support.citrix.com/article/CTX138627; http://osvdb.org/98890
CVE: CVE-2013-6172
Published: 2013-11-05
Description: steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html; http://roundcube.net/news/2013/10/21/security-updates-095-and-087/; http://trac.roundcube.net/ticket/1489382
CVE: CVE-2013-6617
Published: 2013-11-05
Description: The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://docs.saltstack.com/topics/releases/0.17.1.html; http://docs.saltstack.com/topics/releases/0.17.1.html
CVE: CVE-2013-3263
Published: 2013-11-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53170; http://www.securityfocus.com/bid/62621; http://secunia.com/advisories/53170
CVE: CVE-2013-3264
Published: 2013-11-05
Description: The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/53170; http://www.securityfocus.com/bid/62621; http://secunia.com/advisories/53170
CVE: CVE-2013-4419
Published: 2013-11-05
Description: The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html; http://rhn.redhat.com/errata/RHSA-2013-1536.html; http://secunia.com/advisories/55813
CVE: CVE-2013-4453
Published: 2013-11-05
Description: Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726976; http://osvdb.org/98828; http://seclists.org/oss-sec/2013/q4/149
CVE: CVE-2013-4497
Published: 2013-11-05
Description: The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/11/03/2; http://www.openwall.com/lists/oss-security/2013/11/03/3; https://bugs.launchpad.net/nova/+bug/1073306
CVE: CVE-2013-5694
Published: 2013-11-05
Description: SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arbitrary SQL commands via the service_selection parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0149.html; http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes; http://osvdb.org/99038
CVE: CVE-2013-5695
Published: 2013-11-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/auditlog/, (2) PATH_INFO to info/host/ or (3) viewport/, (4) back parameter to login, or (5) "from" parameter to status/service/recheck.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0141.html; http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes; http://archives.neohapsis.com/archives/bugtraq/2013-10/0141.html
CVE: CVE-2013-6618
Published: 2013-11-05
Description: jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows remote authenticated users to execute arbitrary commands via the rsargs parameter in an exec action.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10560; http://secunia.com/advisories/54731; http://www.exploit-db.com/exploits/29544
CVE: CVE-2012-4502
Published: 2013-11-05
Description: Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow.  NOTE: versions 1.27 and 1.28 do not require authentication to exploit.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git%3Ba=commitdiff%3Bh=7712455d9aa33d0db0945effaa07e900b85987b1; http://permalink.gmane.org/gmane.comp.time.chrony.announce/15; http://seclists.org/oss-sec/2013/q3/332
CVE: CVE-2012-4503
Published: 2013-11-05
Description: cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git%3Ba=commitdiff%3Bh=c6fdeeb6bb0b17dc28c19ae492c4a1c498e54ea3; http://permalink.gmane.org/gmane.comp.time.chrony.announce/15; http://seclists.org/oss-sec/2013/q3/332
CVE: CVE-2013-4134
Published: 2013-11-05
Description: OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.debian.org/security/2013/dsa-2729; http://www.mandriva.com/security/advisories?name=MDVSA-2014:244; http://www.openafs.org/pages/security/OPENAFS-SA-2013-003.txt
CVE: CVE-2013-4135
Published: 2013-11-05
Description: The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.debian.org/security/2013/dsa-2729; http://www.mandriva.com/security/advisories?name=MDVSA-2014:244; http://www.openafs.org/pages/security/OPENAFS-SA-2013-004.txt
CVE: CVE-2013-5688
Published: 2013-11-05
Description: Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the file parameter in a (1) download or (2) get_content action, or (3) upload arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the dir parameter in an upload action.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://ajaxplorer.info/ajaxplorer-core-5-0-3/; http://osvdb.org/97022; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-027.txt
CVE: CVE-2013-5689
Published: 2013-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5688. Reason: This issue has been MERGED with CVE-2013-5688 in accordance with CVE content decisions, because it is the same type of vulnerability affecting the same versions. Notes: All CVE users should reference CVE-2013-5688 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3281
Published: 2013-11-06
Description: Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0018.html; http://www.kb.cert.org/vuls/id/466876; http://archives.neohapsis.com/archives/bugtraq/2013-11/0018.html
CVE: CVE-2013-3286
Published: 2013-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4 P11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0019.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0019.html
CVE: CVE-2013-3626
Published: 2013-11-06
Description: Directory traversal vulnerability in the Session Server in Attachmate Verastream Host Integrator (VHI) 6.0 through 7.5 SP 1 HF 1 allows remote attackers to upload and execute arbitrary files via a crafted message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://support.attachmate.com/techdocs/2700.html; http://www.kb.cert.org/vuls/id/436214; http://support.attachmate.com/techdocs/2700.html
CVE: CVE-2013-3906
Published: 2013-11-06
Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2; http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx; http://technet.microsoft.com/security/advisory/2896666
CVE: CVE-2013-4714
Published: 2013-11-06
Description: Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware; http://jvn.jp/en/jp/JVN81813850/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000099
CVE: CVE-2013-4715
Published: 2013-11-06
Description: SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware; http://jvn.jp/en/jp/JVN75720314/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000100
CVE: CVE-2013-5387
Published: 2013-11-06
Description: Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service (process crash or hang) via a malformed SOAP request with a large amount of request data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1020072; http://www.securityfocus.com/bid/63517; https://exchange.xforce.ibmcloud.com/vulnerabilities/87109