deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1123
Published: 2013-02-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the server in Cisco Unified MeetingPlace 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuc65411 and CSCue18706.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90075; http://secunia.com/advisories/52109; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1123
CVE: CVE-2013-1128
Published: 2013-02-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuc64903.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52194; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1128; http://tools.cisco.com/security/center/viewAlert.x?alertId=28217
CVE: CVE-2013-1405
Published: 2013-02-15
Description: VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.vmware.com/security/advisories/VMSA-2013-0001.html; http://www.vmware.com/security/advisories/VMSA-2013-0001.html
CVE: CVE-2012-3286
Published: 2013-02-16
Description: Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700; http://www.kb.cert.org/vuls/id/829260; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700
CVE: CVE-2012-5198
Published: 2013-02-16
Description: Unspecified vulnerability in HP ArcSight Connector Appliance before 6.3 and ArcSight Logger 5.2 and earlier allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700; http://www.kb.cert.org/vuls/id/988100; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700
CVE: CVE-2012-5199
Published: 2013-02-16
Description: Unspecified vulnerability in HP ArcSight Connector Appliance 6.3 and earlier and ArcSight Logger 5.2 and earlier allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03606700
CVE: CVE-2013-0271
Published: 2013-02-16
Description: The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
CVSS Score: 5.0 (MEDIUM)
References: http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html
CVE: CVE-2013-0272
Published: 2013-02-16
Description: Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html
CVE: CVE-2013-0273
Published: 2013-02-16
Description: sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
References: http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html
CVE: CVE-2013-0274
Published: 2013-02-16
Description: upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
CVSS Score: 2.9 (LOW)
References: http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html
CVE: CVE-2012-4398
Published: 2013-02-18
Description: The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://lkml.indiana.edu/hypermail/linux/kernel/1202.0/03340.html
CVE: CVE-2012-4530
Published: 2013-02-18
Description: The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b66c[PII_REDACTED]316fd[PII_REDACTED]49baf1aa33; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html; http://rhn.redhat.com/errata/RHSA-2013-0223.html
CVE: CVE-2013-0160
Published: 2013-02-18
Description: The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2013-0216
Published: 2013-02-18
Description: The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=48856286b64e4b66ec62b94e504d0b29c1ade664; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
CVE: CVE-2013-0217
Published: 2013-02-18
Description: Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d5145d8eb2b9791533ffe4dc003b129b9696c48; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2013-0268
Published: 2013-02-18
Description: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c903f0456bc69176912dee6dd25c6a66ee1aed00; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
CVE: CVE-2013-0871
Published: 2013-02-18
Description: Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9899d11f654474d2d54ea52ceaa2a1f4db3abd68; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
CVE: CVE-2012-4351
Published: 2013-02-18
Description: Integer overflow in pgpwded.sys in Symantec PGP Desktop 10.x and Encryption Desktop 10.3.0 before MP1 allows local users to gain privileges via a crafted application.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/57170; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2013&suid=20130213_00; http://www.securityfocus.com/bid/57170
CVE: CVE-2012-4352
Published: 2013-02-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Stoneware webNetwork 6.1 before SP1 allow remote attackers to inject arbitrary web script or HTML via the blogName parameter to (1) community/blog.jsp or (2) community/blogSearch.jsp, the (3) calendarType or (4) monthNumber parameter to community/calendar.jsp, or the (5) flag parameter to swDashboard/ajax/setAppFlag.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://infosec42.blogspot.com/2012/10/stoneware-webnetwork-61-reflective-xss.html; http://stoneware-docs.s3.amazonaws.com/Bulletins/Security%20Bulletin%206_1_0.pdf; http://infosec42.blogspot.com/2012/10/stoneware-webnetwork-61-reflective-xss.html
CVE: CVE-2012-5374
Published: 2013-02-18
Description: The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (extended runtime of kernel code) by creating many different files whose names are associated with the same CRC32C hash value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://crypto.junod.info/2012/12/13/hash-dos-and-btrfs/; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9c52057c698fb96f8f07e7a4bcf4801a092bda89; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html
CVE: CVE-2012-5375
Published: 2013-02-18
Description: The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (prevention of file creation) by leveraging the ability to write to a directory important to the victim, and creating a file with a crafted name that is associated with a specific CRC32C hash value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://crypto.junod.info/2012/12/13/hash-dos-and-btrfs/; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9c52057c698fb96f8f07e7a4bcf4801a092bda89; http://openwall.com/lists/oss-security/2012/12/13/20
CVE: CVE-2012-6533
Published: 2013-02-18
Description: Buffer overflow in pgpwded.sys in Symantec PGP Desktop 10.x and Encryption Desktop 10.3.0 before MP1 on Windows XP and Server 2003 allows local users to gain privileges via a crafted application.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/57835; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2013&suid=20130213_00; http://www.securityfocus.com/bid/57835
CVE: CVE-2012-6354
Published: 2013-02-19
Description: The management GUI on the IBM SAN Volume Controller and Storwize V7000 6.x before 6.4.1.3 allows remote attackers to bypass authentication and obtain superuser access via IP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004277; https://exchange.xforce.ibmcloud.com/vulnerabilities/80716; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004277
CVE: CVE-2013-0290
Published: 2013-02-19
Description: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=77c1090f94d1b0b5186fb13a1b71b47b1343f87f; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00017.html
CVE: CVE-2013-0765
Published: 2013-02-19
Description: Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 do not prevent multiple wrapping of WebIDL objects, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-23.html
CVE: CVE-2013-0772
Published: 2013-02-19
Description: The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted GIF image.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-1812.html
CVE: CVE-2013-0773
Published: 2013-02-19
Description: The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.debian.org/security/2013/dsa-2699
CVE: CVE-2013-0774
Published: 2013-02-19
Description: Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent JavaScript workers from reading the browser-profile directory name, which has unspecified impact and remote attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-25.html
CVE: CVE-2013-0775
Published: 2013-02-19
Description: Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-0271.html
CVE: CVE-2013-0776
Published: 2013-02-19
Description: Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-0271.html
CVE: CVE-2013-0777
Published: 2013-02-19
Description: Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-28.html
CVE: CVE-2013-0778
Published: 2013-02-19
Description: The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-28.html
CVE: CVE-2013-0779
Published: 2013-02-19
Description: The nsCodingStateMachine::NextState function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-28.html
CVE: CVE-2013-0780
Published: 2013-02-19
Description: Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-0271.html
CVE: CVE-2013-0781
Published: 2013-02-19
Description: Use-after-free vulnerability in the nsPrintEngine::CommonPrint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-28.html
CVE: CVE-2013-0782
Published: 2013-02-19
Description: Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-0271.html
CVE: CVE-2013-0783
Published: 2013-02-19
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://rhn.redhat.com/errata/RHSA-2013-0271.html
CVE: CVE-2013-0784
Published: 2013-02-19
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html; http://www.mozilla.org/security/announce/2013/mfsa2013-21.html
CVE: CVE-2013-1125
Published: 2013-02-19
Description: The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution (LMS), Prime Network Control System, Quad, Context Directory Agent, Prime Collaboration, Unified Provisioning Manager, and Network Services Manager does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCue46001, CSCud95790, CSCue46021, CSCue46025, CSCue46023, CSCue46058, CSCue46013, CSCue46031, CSCue46035, and CSCue46042.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1125; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1125
CVE: CVE-2013-1129
Published: 2013-02-19
Description: Memory leak in Cisco Unity Connection 9.x allows remote attackers to cause a denial of service (memory consumption and process crash) by sending many TCP requests, aka Bug ID CSCud59736.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1129; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1129
CVE: CVE-2012-3316
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in the Tivoli Process Automation Engine (TPAE) in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV24609; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/77813
CVE: CVE-2012-3321
Published: 2013-02-20
Description: IBM SmartCloud Control Desk 7.5 allows remote authenticated users to bypass intended access restrictions via vectors involving an expired password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV25198; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/77916