deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5516
Published: 2013-10-01
Description: The Media Snapshot implementation on Cisco TelePresence Multipoint Switch (CTMS) devices allows remote authenticated users to cause a denial of service (device reload) by sending many Media Snapshot requests at the time of a meeting termination, aka Bug ID CSCuh44796.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5516; http://tools.cisco.com/security/center/viewAlert.x?alertId=31028; http://www.securitytracker.com/id/1029109
CVE: CVE-2013-5725
Published: 2013-10-01
Description: The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html
CVE: CVE-2013-3278
Published: 2013-10-01
Description: EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password, which allows local users to obtain sensitive information by reading the management-server configuration file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0135.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0135.html
CVE: CVE-2013-4042
Published: 2013-10-01
Description: Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-5370.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95738; http://www-01.ibm.com/support/docview.wss?uid=swg21651299; https://exchange.xforce.ibmcloud.com/vulnerabilities/86418
CVE: CVE-2013-5370
Published: 2013-10-01
Description: Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-4042.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95738; http://www-01.ibm.com/support/docview.wss?uid=swg21651299; https://exchange.xforce.ibmcloud.com/vulnerabilities/86658
CVE: CVE-2013-5572
Published: 2013-10-01
Description: Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-09/0149.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html
CVE: CVE-2012-3323
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3 allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/97924; http://secunia.com/advisories/55068; http://secunia.com/advisories/55070
CVE: CVE-2013-0451
Published: 2013-10-01
Description: SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 through 7.1.1.12 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV24726
CVE: CVE-2013-3047
Published: 2013-10-01
Description: IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV35721; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-3048
Published: 2013-10-01
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV36375
CVE: CVE-2013-3049
Published: 2013-10-01
Description: IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-3971.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV37599; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-3971
Published: 2013-10-01
Description: IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-3049.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV37459; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-3972
Published: 2013-10-01
Description: IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV39089; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-3973
Published: 2013-10-01
Description: SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV39184; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-4013
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV39202
CVE: CVE-2013-4014
Published: 2013-10-01
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV39515
CVE: CVE-2013-4017
Published: 2013-10-01
Description: SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/55068; http://www-01.ibm.com/support/docview.wss?uid=swg1IV42682; http://www-01.ibm.com/support/docview.wss?uid=swg21651085
CVE: CVE-2013-4018
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV42684
CVE: CVE-2013-4019
Published: 2013-10-01
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 before 7.1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV42664
CVE: CVE-2013-4020
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV42775
CVE: CVE-2013-4021
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to conduct unspecified file-inclusion attacks via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV42816
CVE: CVE-2013-4027
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV43491
CVE: CVE-2013-5380
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV33364
CVE: CVE-2013-5381
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV35394
CVE: CVE-2013-5382
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5383.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40210
CVE: CVE-2013-5383
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5382.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40704
CVE: CVE-2013-5395
Published: 2013-10-01
Description: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/55068; http://secunia.com/advisories/55070; http://www-01.ibm.com/support/docview.wss?uid=swg1IV32526
CVE: CVE-2011-2901
Published: 2013-10-01
Description: Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2011-1212.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2012-2125
Published: 2013-10-01
Description: RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
CVSS Score: 5.8 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1203.html; http://rhn.redhat.com/errata/RHSA-2013-1441.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE: CVE-2012-2126
Published: 2013-10-01
Description: RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2013-1203.html; http://rhn.redhat.com/errata/RHSA-2013-1441.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE: CVE-2012-5627
Published: 2013-10-01
Description: Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-522
References: http://seclists.org/fulldisclosure/2012/Dec/58; http://seclists.org/fulldisclosure/2012/Dec/83; http://seclists.org/oss-sec/2012/q4/424
CVE: CVE-2013-2231
Published: 2013-10-01
Description: Unquoted Windows search path vulnerability in the QEMU Guest Agent service for Red Hat Enterprise Linux Desktop 6, HPC Node 6, Server 6, Workstation 6, Desktop Supplementary 6, Server Supplementary 6, Supplementary AUS 6.4, Supplementary EUS 6.4.z, and Workstation Supplementary 6, when installing on Windows, allows local users to gain privileges via a crafted program in an unspecified folder.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2013-1100.html; http://rhn.redhat.com/errata/RHSA-2013-1101.html; https://bugzilla.redhat.com/show_bug.cgi?id=980757
CVE: CVE-2013-2269
Published: 2013-10-01
Description: The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in conjunction with information from a "default holding page" to discover the link that is used for sponsor approval of the guest request, then performing a direct request to that link.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/53358; http://www.arubanetworks.com/support/alerts/aid-050813.asc; http://www.securityfocus.com/bid/59805
CVE: CVE-2013-4210
Published: 2013-10-01
Description: The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1369.html; http://rhn.redhat.com/errata/RHSA-2013-1370.html; http://rhn.redhat.com/errata/RHSA-2013-1371.html
CVE: CVE-2013-4355
Published: 2013-10-01
Description: Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.
CVSS Score: 1.5 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-4361
Published: 2013-10-01
Description: The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html; http://security.gentoo.org/glsa/glsa-201407-03.xml
CVE: CVE-2013-4708
Published: 2013-10-01
Description: The PPP Access Concentrator (PPPAC) in Internet Initiative Japan Inc. SEIL/x86 1.00 through 2.80, SEIL/X1 1.00 through 4.30, SEIL/X2 1.00 through 4.30, SEIL/B1 1.00 through 4.30, SEIL/Turbo 1.80 through 2.15, and SEIL/neu 2FE Plus 1.80 through 2.15 generates predictable random numbers, which allows remote attackers to bypass RADIUS authentication by sniffing RADIUS traffic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN40079308/index.html; http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000091.html; http://osvdb.org/97619
CVE: CVE-2013-5745
Published: 2013-10-01
Description: The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00003.html; http://rhn.redhat.com/errata/RHSA-2013-1452.html; http://secunia.com/advisories/55090
CVE: CVE-2013-3539
Published: 2013-10-01
Description: Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-3688
Published: 2013-10-01
Description: The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-3690
Published: 2013-10-01
Description: Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-3962
Published: 2013-10-01
Description: Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models before firmware 1.0.4.44, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://www.grandstream.com/firmware/BETATEST/GXV35xx_GXV36xx_H/Release_Note_GXV35xx_GXV36xx_H1.0.4.44.pdf; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-3963
Published: 2013-10-01
Description: Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-3964
Published: 2013-10-01
Description: Cross-site scripting (XSS) vulnerability in Samsung SHR-5162, SHR-5082, and possibly other models, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Jun/84; http://seclists.org/fulldisclosure/2013/Jun/84
CVE: CVE-2013-5580
Published: 2013-10-01
Description: The (1) Conn_StartLogin and (2) cb_Read_Resolver_Result functions in conn.c in ngIRCd 18 through 20.2, when the configuration option NoticeAuth is enabled, does not properly handle the return code for the Handle_Write function, which allows remote attackers to cause a denial of service (assertion failure and server crash) via unspecified vectors, related to a "notice auth" message not being sent to a new client.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git%3Ba=commit%3Bh=309122017ebc6fff039a7cab1b82f632853d82d5; http://arthur.barton.de/pipermail/ngircd-ml/2013-August/000645.html; http://freecode.com/projects/ngircd/releases/357245
CVE: CVE-2013-1892
Published: 2013-10-01
Description: MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101630.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101679.html
CVE: CVE-2013-2013
Published: 2013-10-01
Description: The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/05/23/4; https://bugs.launchpad.net/python-keystoneclient/+bug/938315; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16937
CVE: CVE-2013-3969
Published: 2013-10-01
Description: The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying/; http://secunia.com/advisories/54170; http://www.mongodb.org/about/alerts/
CVE: CVE-2013-4142
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-3969.  Reason: This candidate is a duplicate of CVE-2013-3969.  Notes: All CVE users should reference CVE-2013-3969 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage