deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4359
Published: 2013-09-30
Description: Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.proftpd.org/show_bug.cgi?id=3973; http://kingcope.wordpress.com/2013/09/11/proftpd-mod_sftpmod_sftp_pam-invalid-pool-allocation-in-kbdint-authentication/; http://lists.opensuse.org/opensuse-updates/2013-10/msg00032.html
CVE: CVE-2013-4372
Published: 2013-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68; http://fusesource.com/issues/browse/FMC-495; http://rhn.redhat.com/errata/RHSA-2013-1286.html
CVE: CVE-2013-5964
Published: 2013-09-30
Description: Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "Administer flags" permission to inject arbitrary web script or HTML via the flag title.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0184.html; http://osvdb.org/96750; http://seclists.org/fulldisclosure/2013/Aug/287
CVE: CVE-2013-5965
Published: 2013-09-30
Description: The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hook_query_alter function, which might allow remote attackers to obtain sensitive information by reading a node listing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0184.html; http://secunia.com/advisories/54550; http://www.openwall.com/lists/oss-security/2013/09/11/9
CVE: CVE-2013-2218
Published: 2013-09-30
Description: Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=244e0b8cf15ca2ef48d82058e728656e6c4bad11; http://libvirt.org/news.html; http://www.openwall.com/lists/oss-security/2013/07/01/6
CVE: CVE-2013-2230
Published: 2013-09-30
Description: The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via unspecified vectors involving "multiple events registration."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=f38c8185f97720ecae7ef2291fbaa5d6b0209e17; http://libvirt.org/news.html; http://www.openwall.com/lists/oss-security/2013/07/10/5
CVE: CVE-2013-4153
Published: 2013-09-30
Description: Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request, as demonstrated by the "virsh vcpucount dom --guest" command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=dfc692350a04a70b4ca65667c30869b3bfdaf034; http://libvirt.org/news.html; http://openwall.com/lists/oss-security/2013/07/19/11
CVE: CVE-2013-4154
Published: 2013-09-30
Description: The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.
CVSS Score: 4.3 (MEDIUM)
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=96518d4316b711c72205117f8d5c967d5127bbb6; http://libvirt.org/news.html; http://openwall.com/lists/oss-security/2013/07/19/12
CVE: CVE-2013-4239
Published: 2013-09-30
Description: The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=0e671a16; http://libvirt.org/news.html; http://www.openwall.com/lists/oss-security/2013/08/12/12
CVE: CVE-2013-4291
Published: 2013-09-30
Description: The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not properly set group memberships, which allows local users to gain privileges.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fe11d34a6d46d6641ce90dc665164fda7bb6bff8; http://libvirt.org/news.html; http://wiki.libvirt.org/page/Maintenance_Releases
CVE: CVE-2013-4292
Published: 2013-09-30
Description: libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://libvirt.org/news.html; http://secunia.com/advisories/60895; http://security.gentoo.org/glsa/glsa-201412-04.xml
CVE: CVE-2013-4296
Published: 2013-09-30
Description: The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=e7f400a110e2e3673b96518170bfea0855dd82c0; http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
CVE: CVE-2013-4297
Published: 2013-09-30
Description: The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=2dba0323ff0cec31bdcea9dd3b2428af297401f2; http://secunia.com/advisories/60895; http://security.gentoo.org/glsa/glsa-201412-04.xml
CVE: CVE-2013-4310
Published: 2013-09-30
Description: Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html; http://archives.neohapsis.com/archives/bugtraq/2013-10/0083.html; http://secunia.com/advisories/54919
CVE: CVE-2013-4314
Published: 2013-09-30
Description: The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00015.html; http://www.debian.org/security/2013/dsa-2763; http://www.openwall.com/lists/oss-security/2013/09/06/2
CVE: CVE-2013-4316
Published: 2013-09-30
Description: Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16, CWE-284
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html; http://struts.apache.org/release/2.3.x/docs/s2-019.html; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2013-5651
Published: 2013-09-30
Description: The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=47b9127e883677a0d60d767030a147450e919a25; http://libvirt.org/news.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
CVE: CVE-2013-5697
Published: 2013-09-30
Description: SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL commands via a Host header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/97588; http://www.baesystemsdetica.com.au/Research/Advisories/mod_accounting-Blind-SQL-Injection-%28DS-2013-006%29; http://osvdb.org/97588
CVE: CVE-2013-4378
Published: 2013-09-30
Description: Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/97778; http://seclists.org/oss-sec/2013/q3/679; http://www.securityfocus.com/bid/62679
CVE: CVE-2013-5961
Published: 2013-09-30
Description: Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/97662; http://packetstormsecurity.com/files/123349; http://www.exploit-db.com/exploits/28452
CVE: CVE-2013-5962
Published: 2013-09-30
Description: Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0090.html; http://codecanyon.net/item/complete-gallery-manager-for-wordpress/2418606; http://packetstormsecurity.com/files/123303
CVE: CVE-2013-5963
Published: 2013-09-30
Description: Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/123235; http://plugins.trac.wordpress.org/changeset?reponame=&old=774214%40simple-dropbox-upload-form%2Ftrunk&new=774214%40simple-dropbox-upload-form%2Ftrunk; http://secunia.com/advisories/54856
CVE: CVE-2013-0211
Published: 2013-09-30
Description: Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101687.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101700.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101872.html
CVE: CVE-2013-1444
Published: 2013-09-30
Description: A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614; http://osvdb.org/97769; http://seclists.org/oss-sec/2013/q3/660
CVE: CVE-2013-1839
Published: 2013-09-30
Description: The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0069.html; http://secunia.com/advisories/52588
CVE: CVE-2013-2238
Published: 2013-09-30
Description: Multiple buffer overflows in the switch_perform_substitution function in switch_regex.c in FreeSWITCH 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the index and substituted variables.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jira.freeswitch.org/browse/FS-5566; http://www.openwall.com/lists/oss-security/2013/07/04/4; http://jira.freeswitch.org/browse/FS-5566
CVE: CVE-2013-4222
Published: 2013-09-30
Description: OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html; http://rhn.redhat.com/errata/RHSA-2013-1524.html; http://www.ubuntu.com/usn/USN-2002-1
CVE: CVE-2013-4362
Published: 2013-09-30
Description: WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/97416; http://osvdb.org/97417; http://savannah.nongnu.org/bugs/?40034
CVE: CVE-2013-4623
Published: 2013-09-30
Description: The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html
CVE: CVE-2013-5692
Published: 2013-09-30
Description: Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php/admin/translationManager.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0117.html; http://osvdb.org/97365; http://www.exploit-db.com/exploits/28557
CVE: CVE-2013-5693
Published: 2013-09-30
Description: Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0117.html; http://osvdb.org/97366; http://www.exploit-db.com/exploits/28557
CVE: CVE-2011-4375
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4376
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4377
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4378
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4379
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4380
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4381
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4382
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4383
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4384
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4385
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4386
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4387
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4388
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4389
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4390
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4391
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4392
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4393
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4394
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4395
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4396
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4397
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4398
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4399
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4400
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4401
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4402
Published: 2013-10-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2012-4096
Published: 2013-10-01
Description: The local file editor in the Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and modify arbitrary fabric-interconnect files, in the context of a vi process, via unspecified commands, aka Bug ID CSCtn06574.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4096; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4096
CVE: CVE-2013-3041
Published: 2013-10-01
Description: The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream via unspecified vectors associated with a "JSON hijacking attack."
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648086; https://exchange.xforce.ibmcloud.com/vulnerabilities/84724; http://www-01.ibm.com/support/docview.wss?uid=swg21648086