deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1959
Published: 2013-05-03
Description: kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6708075f104c3c9b04b23336bb0366ca30c3931b; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e3211c120a85b792978bcb4be7b2886df18d27f0; http://www.exploit-db.com/exploits/25307
CVE: CVE-2013-1979
Published: 2013-05-03
Description: The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=83f1b4ba917db5dc5a061a44b3403ddb6e783494; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html
CVE: CVE-2013-2017
Published: 2013-05-03
Description: The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6ec82562ffc6f297d0de36d65776cff8e5704867; http://www.openwall.com/lists/oss-security/2013/04/29/10
CVE: CVE-2013-3056
Published: 2013-05-03
Description: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html; http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html
CVE: CVE-2013-3057
Published: 2013-05-03
Description: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://developer.joomla.org/security/82-20130402-core-information-disclosure.html; http://developer.joomla.org/security/82-20130402-core-information-disclosure.html
CVE: CVE-2013-3058
Published: 2013-05-03
Description: Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html; http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html
CVE: CVE-2013-3059
Published: 2013-05-03
Description: Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html; http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html
CVE: CVE-2013-3242
Published: 2013-05-03
Description: plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0232.html; http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html; http://karmainsecurity.com/KIS-2013-04
CVE: CVE-2013-3267
Published: 2013-05-03
Description: Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html; http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html
CVE: CVE-2013-1232
Published: 2013-05-04
Description: The HTTP implementation in Cisco WebEx Node for MCS, WebEx Meetings Server, and WebEx Node for ASR 1000 Series allows remote attackers to read the contents of uninitialized memory locations via a crafted request, aka Bug IDs CSCue36672, CSCue31363, CSCuf17466, and CSCug61252.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1232; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1232
CVE: CVE-2013-1235
Published: 2013-05-04
Description: Cisco Wireless LAN Controller (WLC) devices do not properly address the resource consumption of terminated TELNET sessions, which allows remote attackers to cause a denial of service (TELNET outage) by making many TELNET connections and improperly ending these connections, aka Bug ID CSCug35507.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1235; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1235
CVE: CVE-2013-1240
Published: 2013-05-04
Description: The command-line interface in Cisco Unified Communications Manager (CUCM) does not properly validate input, which allows local users to read arbitrary files via unspecified vectors, aka Bug ID CSCue25770.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1240; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1240
CVE: CVE-2013-0726
Published: 2013-05-05
Description: Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows remote attackers to execute arbitrary code via a crafted pathname in an ERS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/51725; http://secunia.com/advisories/51725
CVE: CVE-2013-1092
Published: 2013-05-05
Description: Multiple unquoted Windows search path vulnerabilities in Novell ZENworks Desktop Management (ZDM) 7 through 7.1 might allow local users to gain privileges via a Trojan horse "program" file in the C: folder, related to an attempted launch of (1) ZenRem32.exe or (2) wm.exe.
CVSS Score: 7.2 (HIGH)
References: http://download.novell.com/Download?buildid=hT-LlTRPOfw~; http://www.novell.com/support/kb/doc.php?id=7012147; http://download.novell.com/Download?buildid=hT-LlTRPOfw~
CVE: CVE-2013-1347
Published: 2013-05-05
Description: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://technet.microsoft.com/security/advisory/2847140; http://www.exploit-db.com/exploits/25294; http://www.us-cert.gov/ncas/alerts/TA13-134A
CVE: CVE-2013-2702
Published: 2013-05-05
Description: Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52953; http://secunia.com/advisories/52953
CVE: CVE-2013-2703
Published: 2013-05-05
Description: Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52962; http://wordpress.org/extend/plugins/facebook-members/changelog/; http://secunia.com/advisories/52962
CVE: CVE-2013-0932
Published: 2013-05-07
Description: EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and upload arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html
CVE: CVE-2013-0933
Published: 2013-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html
CVE: CVE-2013-0934
Published: 2013-05-07
Description: EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and modify global reports via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0023.html
CVE: CVE-2013-1241
Published: 2013-05-08
Description: The ISM module in Cisco IOS on ISR G2 routers does not properly handle authentication-header packets, which allows remote authenticated users to cause a denial of service (module reload) via a series of malformed packets, aka Bug ID CSCub92025.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1241; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1241
CVE: CVE-2013-3499
Published: 2013-05-08
Description: GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which allows remote attackers to obtain administrative privileges or access files via a crafted header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/345260; http://www.securityfocus.com/bid/58404; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
CVE: CVE-2013-3500
Published: 2013-05-08
Description: The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt
CVE: CVE-2013-3501
Published: 2013-05-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the foundation-webapp/admin/ directory, (2) the NeDi component, or (3) the Noma component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt
CVE: CVE-2013-3502
Published: 2013-05-08
Description: monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by leveraging a JOSSO SSO cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://www.exploit-db.com/exploits/25001; http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
CVE: CVE-2013-3503
Published: 2013-05-08
Description: The Profile Importer feature in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt
CVE: CVE-2013-3504
Published: 2013-05-08
Description: Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to overwrite arbitrary files by leveraging access to the nagios account.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt
CVE: CVE-2013-3505
Published: 2013-05-08
Description: The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass intended access restrictions via a direct request for a (1) log file or (2) configuration file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/345260; http://www.securityfocus.com/bid/58410; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
CVE: CVE-2013-3506
Published: 2013-05-08
Description: cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt
CVE: CVE-2013-3507
Published: 2013-05-08
Description: The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for (1) a configuration file, (2) a database dump, or (3) the Tomcat status context.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3508
Published: 2013-05-08
Description: html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3509
Published: 2013-05-08
Description: html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3510
Published: 2013-05-08
Description: Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via (1) nedi/html/System-Export.php, (2) nedi/html/Devices-List.php, or (3) the Noma component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3511
Published: 2013-05-08
Description: Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3512
Published: 2013-05-08
Description: The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to read or modify configuration settings via unspecified vectors, as demonstrated by reading credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3513
Published: 2013-05-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) store XSS sequences or (2) delete entries.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/345260; https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt
CVE: CVE-2013-3497
Published: 2013-05-08
Description: Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/93112; http://www.securityfocus.com/bid/59760; https://exchange.xforce.ibmcloud.com/vulnerabilities/84109
CVE: CVE-2013-3498
Published: 2013-05-08
Description: Cross-site scripting (XSS) vulnerability in Juniper SmartPass WLAN Security Management before 7.7 MR3 and 8.0 before MR2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53359; http://www.securitytracker.com/id/1028529; https://exchange.xforce.ibmcloud.com/vulnerabilities/84110
CVE: CVE-2013-0600
Published: 2013-05-09
Description: Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC91726; http://www-01.ibm.com/support/docview.wss?uid=swg21636324; http://www-01.ibm.com/support/docview.wss?uid=swg1IC91726
CVE: CVE-2013-0684
Published: 2013-05-09
Description: SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01
CVE: CVE-2013-0685
Published: 2013-05-09
Description: Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01
CVE: CVE-2013-0686
Published: 2013-05-09
Description: Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01
CVE: CVE-2013-0688
Published: 2013-05-09
Description: Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01
CVE: CVE-2013-1220
Published: 2013-05-09
Description: The CallServer component in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service (call-acceptance outage) via malformed SIP INVITE messages, aka Bug ID CSCua65148.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
CVE: CVE-2013-1221
Published: 2013-05-09
Description: The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38384.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp