deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3273
Published: 2013-07-08
Description: EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0046.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0046.html
CVE: CVE-2013-4782
Published: 2013-07-08
Description: The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://fish2.com/ipmi/cipherzero.html; http://osvdb.org/show/osvdb/93038; http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero
CVE: CVE-2013-4783
Published: 2013-07-08
Description: The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.  NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf; http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx; http://fish2.com/ipmi/cipherzero.html
CVE: CVE-2013-4784
Published: 2013-07-08
Description: The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://fish2.com/ipmi/cipherzero.html; http://osvdb.org/show/osvdb/93040; http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero
CVE: CVE-2013-4785
Published: 2013-07-08
Description: The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request to an unspecified form that is accessible from testurls.html.  NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf; http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx; http://fish2.com/ipmi/dell/secret.html
CVE: CVE-2013-4786
Published: 2013-07-08
Description: The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://fish2.com/ipmi/remote-pw-cracking.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1384&w=2; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2013-1362
Published: 2013-07-09
Description: Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00006.html; http://seclists.org/bugtraq/2013/Feb/119
CVE: CVE-2013-1950
Published: 2013-07-09
Description: The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb12e510f3cadd4060102c9f; http://rhn.redhat.com/errata/RHSA-2013-0884.html; https://bugzilla.redhat.com/show_bug.cgi?id=948378
CVE: CVE-2013-1976
Published: 2013-07-09
Description: The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-0869.html; http://rhn.redhat.com/errata/RHSA-2013-0870.html
CVE: CVE-2013-2051
Published: 2013-07-09
Description: The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale.  NOTE: this issue is due to an incomplete fix for CVE-2012-5887.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0869.html; http://www.securityfocus.com/bid/60187; https://bugzilla.redhat.com/show_bug.cgi?id=959047
CVE: CVE-2013-2052
Published: 2013-07-09
Description: Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records.  NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: https://libreswan.org/security/CVE-2013-2052/CVE-2013-2052.txt; https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html; https://libreswan.org/security/CVE-2013-2052/CVE-2013-2052.txt
CVE: CVE-2013-2053
Published: 2013-07-09
Description: Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records.  NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00008.html; http://rhn.redhat.com/errata/RHSA-2013-0827.html; http://www.debian.org/security/2014/dsa-2893
CVE: CVE-2013-2054
Published: 2013-07-09
Description: Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records.  NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://download.strongswan.org/security/CVE-2013-2054/CVE-2013-2054.txt; http://www.securityfocus.com/bid/59837; https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html
CVE: CVE-2013-2096
Published: 2013-07-09
Description: OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html; http://www.securityfocus.com/bid/59924; http://www.ubuntu.com/usn/USN-1831-1
CVE: CVE-2013-2118
Published: 2013-07-09
Description: SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.
CVSS Score: 7.5 (HIGH)
References: http://contrib.spip.net/SPIP-3-0-9-2-1-22-2-0-23-corrections-de-bug-et-faille?lang=fr; http://core.spip.org/projects/spip/repository/revisions/20541; http://www.debian.org/security/2013/dsa-2694
CVE: CVE-2013-4787
Published: 2013-07-09
Description: Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/; http://review.cyanogenmod.org/#/c/45251/; http://www.osvdb.org/94773
CVE: CVE-2013-1300
Published: 2013-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Allocation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/33213; http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053
CVE: CVE-2013-1340
Published: 2013-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Dereference Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-264, CWE-416
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17273
CVE: CVE-2013-1345
Published: 2013-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17379
CVE: CVE-2013-3115
Published: 2013-07-10
Description: Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3162.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17190
CVE: CVE-2013-3127
Published: 2013-07-10
Description: The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime 11 and Windows Media Player 11 and 12 allows remote attackers to execute arbitrary code via a crafted media file, aka "WMV Video Decoder Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-057; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16998
CVE: CVE-2013-3129
Published: 2013-07-10
Description: Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053
CVE: CVE-2013-3131
Published: 2013-07-10
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures, which allows remote attackers to execute arbitrary code via (1) a crafted .NET Framework application or (2) a crafted Silverlight application, aka "Array Access Violation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17032
CVE: CVE-2013-3132
Published: 2013-07-10
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17430
CVE: CVE-2013-3133
Published: 2013-07-10
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Anonymous Method Injection Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17421
CVE: CVE-2013-3134
Published: 2013-07-10
Description: The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate arrays of structures, which allows remote attackers to execute arbitrary code via a crafted .NET Framework application that changes array data, aka "Array Allocation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17071
CVE: CVE-2013-3143
Published: 2013-07-10
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3161.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140166/Microsoft-Internet-Explorer-9-IEFRAME-CMarkup..RemovePointerPos-Use-After-Free.html; http://www.us-cert.gov/ncas/alerts/TA13-190A
CVE: CVE-2013-3144
Published: 2013-07-10
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3151 and CVE-2013-3163.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17024
CVE: CVE-2013-3145
Published: 2013-07-10
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3150.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16872
CVE: CVE-2013-3146
Published: 2013-07-10
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3152.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16815
CVE: CVE-2013-3147
Published: 2013-07-10
Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16966
CVE: CVE-2013-3148
Published: 2013-07-10
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3153.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17034
CVE: CVE-2013-3149
Published: 2013-07-10
Description: Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16821
CVE: CVE-2013-3150
Published: 2013-07-10
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3145.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17012
CVE: CVE-2013-3151
Published: 2013-07-10
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3163.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17088
CVE: CVE-2013-3152
Published: 2013-07-10
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3146.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16975
CVE: CVE-2013-3153
Published: 2013-07-10
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3148.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16927
CVE: CVE-2013-3154
Published: 2013-07-10
Description: The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper Pathname Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx; http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-058
CVE: CVE-2013-3161
Published: 2013-07-10
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3143.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-190A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17301