deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2751
Published: 2013-12-12
Description: Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.html; http://www.exploit-db.com/exploits/29815; http://www.osvdb.org/98826
CVE: CVE-2013-2752
Published: 2013-12-12
Description: Cross-site request forgery (CSRF) vulnerability in frontview/lib/np_handler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.osvdb.org/98825; http://www.readynas.com/?p=7002; http://www.tripwire.com/register/security-advisory-netgear-readynas/
CVE: CVE-2013-4458
Published: 2013-12-12
Description: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:283; http://www.mandriva.com/security/advisories?name=MDVSA-2013:284
CVE: CVE-2013-4566
Published: 2013-12-12
Description: mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html; http://rhn.redhat.com/errata/RHSA-2013-1779.html; https://bugzilla.redhat.com/show_bug.cgi?id=1016832
CVE: CVE-2013-6045
Published: 2013-12-12
Description: Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://osvdb.org/100636; http://osvdb.org/100637
CVE: CVE-2013-6052
Published: 2013-12-12
Description: OpenJPEG 1.3 and earlier allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://rhn.redhat.com/errata/RHSA-2013-1850.html; http://seclists.org/oss-sec/2013/q4/412
CVE: CVE-2013-6054
Published: 2013-12-12
Description: Heap-based buffer overflow in OpenJPEG 1.3 has unspecified impact and remote vectors, a different vulnerability than CVE-2013-6045.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://osvdb.org/100639; http://rhn.redhat.com/errata/RHSA-2013-1850.html
CVE: CVE-2013-6421
Published: 2013-12-12
Description: The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0077.html; http://vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html; http://www.openwall.com/lists/oss-security/2013/12/03/1
CVE: CVE-2013-5763
Published: 2013-12-12
Description: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Maintenance.  NOTE: the original disclosure of this issue erroneously mapped it to CVE-2013-3624.
CVSS Score: 1.5 (LOW)
References: http://secunia.com/advisories/56237; http://secunia.com/advisories/56241; http://secunia.com/advisories/56243
CVE: CVE-2013-4988
Published: 2013-12-13
Description: Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0046.html; http://osvdb.org/100826; http://packetstormsecurity.com/files/124380/IcoFX-2.5.0.0-Buffer-Overflow.html
CVE: CVE-2013-6005
Published: 2013-12-13
Description: Cross-site scripting (XSS) vulnerability in Cybozu Dezie before 8.1.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Cancel button.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131209up11.php; http://jvn.jp/en/jp/JVN21336955/index.html; http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000118.html
CVE: CVE-2013-6839
Published: 2013-12-13
Description: SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0049.html; http://secunia.com/advisories/56041; http://www.instantcms.ru/novosti/security-update-1-10-3.html
CVE: CVE-2012-5394
Published: 2013-12-13
Description: Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE: CVE-2013-0348
Published: 2013-12-13
Description: thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00050.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00015.html; http://opensource.dyc.edu/gitweb/?p=sthttpd.git%3Ba=commitdiff%3Bh=d2e186dbd58d274a0dea9b59357edc8498b5388d
CVE: CVE-2013-4567
Published: 2013-12-13
Description: Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE: CVE-2013-4568
Published: 2013-12-13
Description: Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE: CVE-2013-4569
Published: 2013-12-13
Description: The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE: CVE-2013-6394
Published: 2013-12-13
Description: Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00052.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00044.html; http://www.openwall.com/lists/oss-security/2013/11/26/11
CVE: CVE-2013-6956
Published: 2013-12-13
Description: Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r17, 7.3 before 7.3r8, 7.4 before 7.4r6, and 8.0 before 8.0r1, when web rewrite is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/100862; http://www.securitytracker.com/id/1029489; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10602
CVE: CVE-2013-6957
Published: 2013-12-13
Description: Cross-site scripting (XSS) vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100860; http://www.securitytracker.com/id/1029491; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10603
CVE: CVE-2013-6958
Published: 2013-12-13
Description: Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause a denial of service via a crafted packet.
CVSS Score: 7.1 (HIGH)
References: http://jvn.jp/en/jp/JVN28436508/index.html; http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000119.html; http://osvdb.org/100861
CVE: CVE-2013-7050
Published: 2013-12-13
Description: The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849; http://osvdb.org/100855
CVE: CVE-2013-7091
Published: 2013-12-13
Description: Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a ..  (dot dot) in the skin parameter.  NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/100747; http://packetstormsecurity.com/files/124321; http://www.exploit-db.com/exploits/30085
CVE: CVE-2013-7092
Published: 2013-12-13
Description: Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6) emailstatus_col JSON keys.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/100582; http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Dec/18
CVE: CVE-2012-6151
Published: 2013-12-13
Description: Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; http://seclists.org/oss-sec/2013/q4/398
CVE: CVE-2013-5676
Published: 2013-12-13
Description: The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2013/Dec/37; http://www.osvdb.org/100666; http://seclists.org/fulldisclosure/2013/Dec/37
CVE: CVE-2013-6048
Published: 2013-12-13
Description: The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2013/dsa-2815; http://www.ubuntu.com/usn/USN-2090-1; https://github.com/munin-monitoring/munin/blob/2.0.18/ChangeLog
CVE: CVE-2013-6359
Published: 2013-12-13
Description: Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses "multigraph" as a multigraph service name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://munin-monitoring.org/ticket/1397; http://www.debian.org/security/2013/dsa-2815; http://www.ubuntu.com/usn/USN-2090-1
CVE: CVE-2013-6400
Published: 2013-12-13
Description: Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125081.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125111.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html
CVE: CVE-2013-6809
Published: 2013-12-13
Description: Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the Remote File field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://osvdb.org/100511; http://packetstormsecurity.com/files/124275/Tftpd32-Client-Side-Format-String.html; http://seclists.org/fulldisclosure/2013/Dec/15
CVE: CVE-2013-7038
Published: 2013-12-13
Description: The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/55903; http://security.gentoo.org/glsa/glsa-201402-01.xml; http://www.openwall.com/lists/oss-security/2013/12/09/11
CVE: CVE-2013-7039
Published: 2013-12-13
Description: Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/55903; http://security.gentoo.org/glsa/glsa-201402-01.xml; http://www.openwall.com/lists/oss-security/2013/12/09/11
CVE: CVE-2013-7093
Published: 2013-12-13
Description: SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://scn.sap.com/docs/DOC-8218; https://erpscan.io/advisories/erpscan-13-023-saprouter-authentication-bypass/; https://exchange.xforce.ibmcloud.com/vulnerabilities/89604
CVE: CVE-2013-7094
Published: 2013-12-13
Description: SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/56061; http://www.securityfocus.com/bid/64232
CVE: CVE-2013-7095
Published: 2013-12-13
Description: The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
CVSS Score: 10.0 (HIGH)
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/56064; http://www.securityfocus.com/bid/64265
CVE: CVE-2013-7096
Published: 2013-12-13
Description: Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://scn.sap.com/docs/DOC-8218; http://www.securityfocus.com/bid/64314; https://erpscan.io/advisories/erpscan-13-024-sap-emr-unwired-multiple-sql-injections/
CVE: CVE-2013-1364
Published: 2013-12-14
Description: The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/55824; http://security.gentoo.org/glsa/glsa-201311-15.xml; http://www.securityfocus.com/bid/57471
CVE: CVE-2013-5107
Published: 2013-12-14
Description: Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the ROCK_LANG cookie, as demonstrated in a login.index action to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt
CVE: CVE-2013-6051
Published: 2013-12-14
Description: The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730513; http://git.savannah.gnu.org/gitweb/?p=quagga.git%3Ba=commitdiff%3Bh=8794e8d229dc9fe29ea[PII_REDACTED]3d4880ef408; http://www.debian.org/security/2013/dsa-2803
CVE: CVE-2013-6391
Published: 2013-12-14
Description: The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-269
References: http://rhn.redhat.com/errata/RHSA-2014-0089.html; http://secunia.com/advisories/56079; http://secunia.com/advisories/56154
CVE: CVE-2013-6411
Published: 2013-12-14
Description: The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.openttd.org/task/5820; http://lists.opensuse.org/opensuse-updates/2013-12/msg00095.html; http://seclists.org/oss-sec/2013/q4/375
CVE: CVE-2013-6426
Published: 2013-12-14
Description: The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0090.html; http://www.openwall.com/lists/oss-security/2013/12/11/9; http://www.securityfocus.com/bid/64243
CVE: CVE-2013-6428
Published: 2013-12-14
Description: The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0090.html; http://seclists.org/oss-sec/2013/q4/479; https://launchpad.net/bugs/1256983
CVE: CVE-2013-7069
Published: 2013-12-14
Description: ack 2.00 through 2.11_02 allows remote attackers to execute arbitrary code via a (1) --pager, (2) --regex, or (3) --output option in a .ackrc file in a directory to be searched.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-updates/2014-01/msg00094.html; http://seclists.org/oss-sec/2013/q4/484; http://secunia.com/advisories/55982
CVE: CVE-2013-7085
Published: 2013-12-14
Description: Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732006; http://osvdb.org/100917; http://www.openwall.com/lists/oss-security/2013/12/12/9
CVE: CVE-2013-7103
Published: 2013-12-14
Description: McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a (1) TestFile XML element or the (2) hostname.  NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://osvdb.org/100581; http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Dec/18
CVE: CVE-2013-7104
Published: 2013-12-14
Description: McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a (1) Command or (2) Script XML element.  NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://osvdb.org/100581; http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Dec/18
CVE: CVE-2013-4587
Published: 2013-12-14
Description: Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338c7dbadd2671189cec7faf64c84d01071b3f96; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html