deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3538
Published: 2013-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id_post or (2) pg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/92319; http://packetstormsecurity.com/files/121290/Todoo-Forum-2.0-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/59069
CVE: CVE-2013-2094
Published: 2013-05-14
Description: The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
CVSS Score: 8.4 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d[PII_REDACTED]764894e94e02f; http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html; http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html
CVE: CVE-2013-0096
Published: 2013-05-15
Description: Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-045; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16204
CVE: CVE-2013-0811
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1307.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15979
CVE: CVE-2013-1297
Published: 2013-05-15
Description: Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16518
CVE: CVE-2013-1301
Published: 2013-05-15
Description: Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka "XML External Entities Resolution Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-044; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16750
CVE: CVE-2013-1302
Published: 2013-05-15
Description: Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952
CVE: CVE-2013-1305
Published: 2013-05-15
Description: HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header, aka "HTTP.sys Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-039; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16088
CVE: CVE-2013-1306
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1313.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140092/Microsoft-Internet-Explorer-9-MSHTML-CDispNode-InsertSiblingNode-Use-After-Free.html; http://www.us-cert.gov/ncas/alerts/TA13-134A
CVE: CVE-2013-1307
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-0811.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16650
CVE: CVE-2013-1308
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1309 and CVE-2013-2551.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16415
CVE: CVE-2013-1309
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-2551.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140094/Microsoft-Internet-Explorer-MSHTML-CDispNode-InsertSiblingNode-Use-After-Free.html; http://www.us-cert.gov/ncas/alerts/TA13-134A
CVE: CVE-2013-1310
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16689
CVE: CVE-2013-1311
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; http://www.us-cert.gov/ncas/alerts/TA13-134A
CVE: CVE-2013-1312
Published: 2013-05-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16328
CVE: CVE-2013-1316
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Negative Value Allocation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16584
CVE: CVE-2013-1317
Published: 2013-05-15
Description: Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16548
CVE: CVE-2013-1318
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an invalid pointer, aka "Publisher Corrupt Interface Pointer Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16682
CVE: CVE-2013-1319
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Handling Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16749
CVE: CVE-2013-1320
Published: 2013-05-15
Description: Buffer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Buffer Overflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16776
CVE: CVE-2013-1321
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16525
CVE: CVE-2013-1322
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Invalid Range Check Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16669
CVE: CVE-2013-1323
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Incorrect NULL Value Handling Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16733
CVE: CVE-2013-1327
Published: 2013-05-15
Description: Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper memory allocation, aka "Publisher Signed Integer Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16355
CVE: CVE-2013-1328
Published: 2013-05-15
Description: Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers incorrect pointer handling, aka "Publisher Pointer Handling Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16765
CVE: CVE-2013-1329
Published: 2013-05-15
Description: Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers a buffer underflow, aka "Publisher Buffer Underflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-042; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16554
CVE: CVE-2013-1332
Published: 2013-05-15
Description: dxgkrnl.sys (aka the DirectX graphics kernel subsystem) in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "DirectX Graphics Kernel Subsystem Double Fetch Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/53385; http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-046
CVE: CVE-2013-1333
Published: 2013-05-15
Description: Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Buffer Overflow Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/53385; http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-046
CVE: CVE-2013-1334
Published: 2013-05-15
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/53385; http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-046
CVE: CVE-2013-1335
Published: 2013-05-15
Description: Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code via crafted shape data in a Word document, aka "Word Shape Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-043; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16229
CVE: CVE-2013-1336
Published: 2013-05-15
Description: The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allows remote attackers to make undetected changes to signed XML documents via unspecified vectors that preserve signature validity, aka "XML Digital Signature Spoofing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-040; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16559
CVE: CVE-2013-1337
Published: 2013-05-15
Description: Microsoft .NET Framework 4.5 does not properly create policy requirements for custom Windows Communication Foundation (WCF) endpoint authentication in certain situations involving passwords over HTTPS, which allows remote attackers to bypass authentication by sending queries to an endpoint, aka "Authentication Bypass Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.us-cert.gov/ncas/alerts/TA13-134A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-040; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16741
CVE: CVE-2013-1346
Published: 2013-05-15
Description: mpengine.dll in Microsoft Malware Protection Engine before 1.1.9506.0 on x64 platforms allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://technet.microsoft.com/security/advisory/2846338; http://technet.microsoft.com/security/advisory/2846338
CVE: CVE-2013-1175
Published: 2013-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This issue was announced by the vendor and later withdrawn because it was not a vulnerability.  Notes: none
CVE: CVE-2013-1188
Published: 2013-05-16
Description: Cisco Unified Communications Manager (CUCM) does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service (application slowdown) via a series of requests, aka Bug ID CSCud39515.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1188; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1188
CVE: CVE-2013-1200
Published: 2013-05-16
Description: Session fixation vulnerability in Cisco Secure Access Control System (ACS) allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1200; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1200
CVE: CVE-2013-1236
Published: 2013-05-16
Description: Cisco TelePresence Supervisor MSE 8050 before 2.3(1.31) allows remote attackers to cause a denial of service (CPU consumption or device reload) by establishing TCP connections at a high rate, aka Bug IDs CSCuf76076 and CSCuf79763.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130515-mse; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130515-mse
CVE: CVE-2013-1244
Published: 2013-05-16
Description: Cross-site scripting (XSS) vulnerability in the portal module in Cisco WebEx Social allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL in the link field in a post, aka Bug ID CSCue67199.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1244; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1244
CVE: CVE-2013-1245
Published: 2013-05-16
Description: The user-management page in Cisco WebEx Social relies on client-side validation of values in the Screen Name, First Name, Middle Name, Last Name, Email Address, and Job Title fields, which allows remote authenticated users to bypass intended access restrictions via crafted requests, aka Bug ID CSCue67190.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1245; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1245
CVE: CVE-2013-0801
Published: 2013-05-16
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
CVE: CVE-2013-1389
Published: 2013-05-16
Description: Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb13-13.html; http://www.adobe.com/support/security/bulletins/apsb13-13.html
CVE: CVE-2013-1669
Published: 2013-05-16
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 21.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
CVE: CVE-2013-1670
Published: 2013-05-16
Description: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
CVE: CVE-2013-1671
Published: 2013-05-16
Description: Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html; http://www.mozilla.org/security/announce/2013/mfsa2013-43.html