deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6632
Published: 2013-11-18
Description: Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2013/11/chrome-for-android-update.html; http://googlechromereleases.blogspot.com/2013/11/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
CVE: CVE-2013-6801
Published: 2013-11-18
Description: Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .doc file containing an embedded image, as demonstrated by word2003forkbomb.doc, related to a "fork bomb" issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0035.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0038.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0045.html
CVE: CVE-2013-6802
Published: 2013-11-18
Description: Google Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions by leveraging access to a renderer process, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013, a different vulnerability than CVE-2013-6632.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/11/chrome-for-android-update.html; http://googlechromereleases.blogspot.com/2013/11/stable-channel-update_14.html; http://www.hppwn2own.com/chrome-nexus-4-samsung-galaxy-s4-falls/
CVE: CVE-2013-0741
Published: 2013-11-19
Description: Cross-site scripting (XSS) vulnerability in imagegen.ashx in Percipient Studios ImageGen before 2.9.0 for Umbraco CMS allows remote attackers to inject arbitrary web script or HTML via the font parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99343; http://our.umbraco.org/projects/website-utilities/imagegen; http://secunia.com/advisories/52771
CVE: CVE-2013-2271
Published: 2013-11-19
Description: The D-Link DSL-2740B Gateway with firmware EU_1.0, when an active administrator session exists, allows remote attackers to bypass authentication and gain administrator access via a request to login.cgi.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/120613/dlinkdsl2740b-bypass.txt; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10004; http://www.webapp-security.com/2013/03/d-link-dsl-2740b-adsl-router-authentication-bypass
CVE: CVE-2013-4519
Published: 2013-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99512; http://osvdb.org/99513; http://secunia.com/advisories/55623
CVE: CVE-2013-5223
Published: 2013-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://osvdb.org/99603; http://osvdb.org/99604; http://osvdb.org/99605
CVE: CVE-2013-6042
Published: 2013-11-19
Description: Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo before 2.1.4 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99203; http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29; http://www.securityfocus.com/bid/63464
CVE: CVE-2013-6629
Published: 2013-11-19
Description: The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2013-0333.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html; http://bugs.ghostscript.com/show_bug.cgi?id=686980
CVE: CVE-2013-6630
Published: 2013-11-19
Description: The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2013-0333.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html; http://git.chromium.org/gitweb/?p=chromium/deps/libjpeg_turbo.git%3Ba=commit%3Bh=32cab49bd4cb1ce069a435fd75f9439c34ddc6f8
CVE: CVE-2013-6631
Published: 2013-11-19
Description: Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6797
Published: 2013-11-19
Description: Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php, as demonstrated by embedding a URL to a JavaScript file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/98922; http://osvdb.org/98923; http://securityundefined.com/wordpress-plugin-blue-wrench-video-widget-csrf-persistent-xss-0day-disclosure/
CVE: CVE-2013-3095
Published: 2013-11-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. A1) with firmware before 1.05b07 allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password or (2) enable remote management via a request to hedwig.cgi or (3) activate configuration changes via a request to pigwidgeon.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53064; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10003; http://securityevaluators.com/content/case-studies/routers/dlink_dir865l.jsp
CVE: CVE-2013-4507
Published: 2013-11-20
Description: Cross-site scripting (XSS) vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55481; http://www.collectiveaccess.org/news/collectiveaccess-version-1-3-1-released; http://secunia.com/advisories/55481
CVE: CVE-2013-4563
Published: 2013-11-20
Description: The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.
CVSS Score: 7.1 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288e; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html; http://www.openwall.com/lists/oss-security/2013/11/13/9
CVE: CVE-2013-4579
Published: 2013-11-20
Description: The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729573; http://www.mathyvanhoef.com/2013/11/unmasking-spoofed-mac-address.html; http://www.openwall.com/lists/oss-security/2013/11/15/3
CVE: CVE-2013-4588
Published: 2013-11-20
Description: Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://ftp.linux.org.uk/pub/linux/linux-2.6/ChangeLog-2.6.33; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=04bcef2a83f40c6db24222b27a52892cba39dffb; http://www.openwall.com/lists/oss-security/2013/11/15/12
CVE: CVE-2013-4591
Published: 2013-11-20
Description: Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d3e91a89b7adbc2831334def9e494dd9892f9af; http://rhn.redhat.com/errata/RHSA-2013-1645.html; http://rhn.redhat.com/errata/RHSA-2014-0284.html
CVE: CVE-2013-4592
Published: 2013-11-20
Description: Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=12d6e7538e2d418c08f082b1b44ffa5fb7270ed8; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40f193f5bb022e927a57a4f5d5194e4f12ddb74; http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
CVE: CVE-2013-5215
Published: 2013-11-20
Description: Cross-site scripting (XSS) vulnerability in the web interface "WiFi scan" option in FOSCAM Wireless IP Cameras allows remote attackers to inject arbitrary web script or HTML via the SSID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0046.html; http://osvdb.org/99550; http://packetstormsecurity.com/files/123943/FOSCAM-Wireless-IP-Camera-Cross-Site-Scripting.html
CVE: CVE-2013-5730
Published: 2013-11-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or disable Wireless MAC Address Filters via a wlFltMode action to wlmacflt.cmd, (2) enable or disable firewall protections via a request to scdmz.cmd, or (3) enable or disable remote management via a save action to scsrvcntr.cmd.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/123200/D-Link-DSL-2740B-Cross-Site-Request-Forgery.html; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10004; http://www.webapp-security.com/2013/09/d-link-dsl-2740b-multiple-csrf-vulnerabilities
CVE: CVE-2013-5966
Published: 2013-11-20
Description: Cross-site scripting (XSS) vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0101.html; http://secunia.com/advisories/55690; https://github.com/zkoss/zk/blob/v5.0.13/zkdoc/release-note
CVE: CVE-2013-6074
Published: 2013-11-20
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0025.html; http://osvdb.org/99487; http://packetstormsecurity.com/files/123934/Open-Xchange-AppSuite-Script-Insertion.html
CVE: CVE-2013-6282
Published: 2013-11-20
Description: The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04; http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
CVE: CVE-2013-4386
Published: 2013-11-20
Description: Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://projects.theforeman.org/issues/3160; http://rhn.redhat.com/errata/RHSA-2013-1522.html; https://groups.google.com/forum/#%21topic/foreman-announce/GKMNXM66Z84
CVE: CVE-2013-4466
Published: 2013-11-20
Description: Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7049; http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7050; http://www.gnutls.org/security.html#GNUTLS-SA-2013-3
CVE: CVE-2013-4487
Published: 2013-11-20
Description: Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.  NOTE: this issue is due to an incomplete fix for CVE-2013-4466.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00064.html; http://www.openwall.com/lists/oss-security/2013/10/31/4; https://gitorious.org/gnutls/gnutls/commit/0dd5529509e46b11d5c0f3f26f99294e0e5fa6dc
CVE: CVE-2013-4495
Published: 2013-11-20
Description: The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/55535; http://secunia.com/advisories/55622; https://www.adaptivecomputing.com/wp-content/uploads/releasenotes/releaseNotes-4.2.6.html
CVE: CVE-2013-4559
Published: 2013-11-20
Description: lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt; http://jvn.jp/en/jp/JVN37417423/index.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
CVE: CVE-2013-4560
Published: 2013-11-20
Description: Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-416
References: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt; http://jvn.jp/en/jp/JVN37417423/index.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
CVE: CVE-2013-6814
Published: 2013-11-20
Description: The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55778; https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/
CVE: CVE-2013-6815
Published: 2013-11-20
Description: The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55620; https://erpscan.io/advisories/erpscan-13-020-sap-netweaver-shsti_upload_xml-xxe/
CVE: CVE-2013-6816
Published: 2013-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55777; https://erpscan.io/advisories/erpscan-13-018-sap-netweaver-servlet-javadumpservice-multiple-xss/
CVE: CVE-2013-6817
Published: 2013-11-20
Description: Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-013-saprouter-heap-overflow/; https://service.sap.com/sap/support/notes/1820666
CVE: CVE-2013-6818
Published: 2013-11-20
Description: SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-008-sap-netweaver-logviewer-security-check-bypass/; https://service.sap.com/sap/support/notes/1685106
CVE: CVE-2013-6819
Published: 2013-11-20
Description: Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-006-sap-netweaver-performance-provider-xss/; https://service.sap.com/sap/support/notes/1784894
CVE: CVE-2013-6820
Published: 2013-11-20
Description: Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-004-sap-netweaver-di-arbitrary-file-upload/; https://service.sap.com/sap/support/notes/1757675
CVE: CVE-2013-6821
Published: 2013-11-20
Description: Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-003-sap-netweaver-exportability-check-service-unauthorized-directory-traversal/; https://service.sap.com/sap/support/notes/1628537
CVE: CVE-2013-6822
Published: 2013-11-20
Description: GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue.
CVSS Score: 10.0 (HIGH)
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-002-sap-grmgapp-xxe-and-authentication-bypass/; http://scn.sap.com/docs/DOC-8218
CVE: CVE-2013-6823
Published: 2013-11-20
Description: GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/dsecrg-13-002-sap-grmgapp-xxe-and-authentication-bypass/; http://scn.sap.com/docs/DOC-8218
CVE: CVE-2013-6826
Published: 2013-11-20
Description: cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt; http://www.securityfocus.com/bid/63663; http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt
CVE: CVE-2013-1417
Published: 2013-11-20
Description: do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html; http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt; https://bugzilla.redhat.com/show_bug.cgi?id=1030743