deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4404
Published: 2013-12-23
Description: cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended role restrictions and obtain sensitive information or perform privileged operations via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=995038; http://rhn.redhat.com/errata/RHSA-2013-1851.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE: CVE-2013-4405
Published: 2013-12-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998561; http://rhn.redhat.com/errata/RHSA-2013-1851.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE: CVE-2013-4414
Published: 2013-12-23
Description: Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606; http://rhn.redhat.com/errata/RHSA-2013-1851.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE: CVE-2013-4461
Published: 2013-12-23
Description: SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://rhn.redhat.com/errata/RHSA-2013-1851.html; http://rhn.redhat.com/errata/RHSA-2013-1852.html; https://bugzilla.redhat.com/show_bug.cgi?id=1016263
CVE: CVE-2013-4549
Published: 2013-12-23
Description: QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00044.html
CVE: CVE-2013-5420
Published: 2013-12-23
Description: The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to read log files by leveraging helpdesk privileges for a direct request.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21660211; https://exchange.xforce.ibmcloud.com/vulnerabilities/87482; http://www-01.ibm.com/support/docview.wss?uid=swg21660211
CVE: CVE-2013-6422
Published: 2013-12-23
Description: The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://curl.haxx.se/docs/adv_20131217.html; http://www.debian.org/security/2013/dsa-2824; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html
CVE: CVE-2013-6439
Published: 2013-12-23
Description: Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2013-1863.html; https://bugzilla.redhat.com/show_bug.cgi?id=1042677; https://exchange.xforce.ibmcloud.com/vulnerabilities/90134
CVE: CVE-2013-6449
Published: 2013-12-23
Description: The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ca989269a2876bae79393bd54c3e72d49975fc75; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124833.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124854.html
CVE: CVE-2013-6890
Published: 2013-12-23
Description: denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://seclists.org/oss-sec/2013/q4/535; http://secunia.com/advisories/56239; http://www.debian.org/security/2013/dsa-2826
CVE: CVE-2013-6979
Published: 2013-12-23
Description: The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, aka Bug ID CSCuj90227.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/101351; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6979; http://www.securityfocus.com/bid/64502
CVE: CVE-2013-3709
Published: 2013-12-23
Description: WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html
CVE: CVE-2013-4424
Published: 2013-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-1843.html; http://rhn.redhat.com/errata/RHSA-2013-1843.html
CVE: CVE-2013-7049
Published: 2013-12-23
Description: Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/100859; http://seclists.org/oss-sec/2013/q4/482; http://seclists.org/oss-sec/2013/q4/489
CVE: CVE-2013-7073
Published: 2013-12-23
Description: The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
CVE: CVE-2013-7075
Published: 2013-12-23
Description: The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/oss-sec/2013/q4/473; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/; http://www.debian.org/security/2014/dsa-2834
CVE: CVE-2013-7079
Published: 2013-12-23
Description: Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2013/q4/473; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/; http://www.debian.org/security/2014/dsa-2834
CVE: CVE-2013-7080
Published: 2013-12-23
Description: The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."
CVSS Score: 5.8 (MEDIUM)
References: http://seclists.org/oss-sec/2013/q4/473; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/; http://www.debian.org/security/2014/dsa-2834
CVE: CVE-2013-7081
Published: 2013-12-23
Description: The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/473; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/; http://www.debian.org/security/2014/dsa-2834
CVE: CVE-2013-7102
Published: 2013-12-23
Description: Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://blog.sucuri.net/2013/12/wordpress-optimizepress-theme-file-upload-vulnerability.html; http://help.optimizepress.com/customer/portal/articles/1381790-important-optimizepress-1-0-security-update; http://seclists.org/fulldisclosure/2013/Dec/127
CVE: CVE-2013-4550
Published: 2013-12-24
Description: Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. NOTE: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121868.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122274.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122278.html
CVE: CVE-2013-6403
Published: 2013-12-24
Description: The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/changelog/; http://secunia.com/advisories/55792; http://www.openwall.com/lists/oss-security/2013/11/28/6
CVE: CVE-2013-6795
Published: 2013-12-24
Description: The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0122.html; http://blog.cloudpassage.com/2013/11/18/cve-2013-6795-vulnerability-rackspace-windows-agent-updater/; http://osvdb.org/100191
CVE: CVE-2011-5268
Published: 2013-12-24
Description: connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550.  NOTE: this issue was SPLIT from CVE-2013-4550 because it is a different type of issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121868.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122274.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122278.html
CVE: CVE-2013-4358
Published: 2013-12-24
Description: libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data.
CVSS Score: 5.0 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=072be3e8969f24113d599444be4d6a0ed04a6602; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=072be3e8969f24113d599444be4d6a0ed04a6602
CVE: CVE-2013-4452
Published: 2013-12-24
Description: Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-1762.html; http://secunia.com/advisories/55852; http://www.securityfocus.com/bid/63916
CVE: CVE-2013-4553
Published: 2013-12-24
Description: The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
CVE: CVE-2013-4554
Published: 2013-12-24
Description: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2012-6615
Published: 2013-12-24
Description: The ff_ass_split_override_codes function in libavcodec/ass_split.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a subtitle dialog without text.
CVSS Score: 4.3 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=20c121c00747d6c3b0b0f98deeff021171b2ed74; http://secunia.com/advisories/51964; http://www.ffmpeg.org/security.html
CVE: CVE-2012-6616
Published: 2013-12-24
Description: The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=68e48ed72e0597ae61bc3e9e6e6d9edcb1a00073; http://secunia.com/advisories/51964; http://www.ffmpeg.org/security.html
CVE: CVE-2012-6617
Published: 2013-12-24
Description: The prepare_sdp_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via vectors related to the rtp format.
CVSS Score: 4.3 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9929991da7b843e7d80154fcacc4e80579b86a2d; http://secunia.com/advisories/51964; http://www.ffmpeg.org/security.html
CVE: CVE-2012-6618
Published: 2013-12-24
Description: The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient "frames to estimate rate."
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.video.ffmpeg.user/42233; http://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v9.11; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=e74cd2f4706f71da5e9205003c1d8263b54ed3fb
CVE: CVE-2013-6387
Published: 2013-12-24
Description: Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.debian.org/security/2013/dsa-2804; http://www.openwall.com/lists/oss-security/2013/11/22/4; https://drupal.org/SA-CORE-2013-003
CVE: CVE-2013-6388
Published: 2013-12-24
Description: Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2013/dsa-2804; http://www.openwall.com/lists/oss-security/2013/11/22/4; https://drupal.org/SA-CORE-2013-003
CVE: CVE-2013-7216
Published: 2013-12-24
Description: Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101073; http://osvdb.org/101074; http://packetstormsecurity.com/files/124442
CVE: CVE-2013-7217
Published: 2013-12-26
Description: Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091.
CVSS Score: 10.0 (HIGH)
References: http://bugzilla.zimbra.com/show_bug.cgi?id=84547; http://files.zimbra.com/website/docs/7.2/Zimbra_OS_Release_Notes_7.2.6.pdf; http://files.zimbra.com/website/docs/8.0/Zimbra_OS_Release_Notes_8.0.6.pdf
CVE: CVE-2010-0430
Published: 2013-12-27
Description: libspice, as used in QEMU-KVM in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 and possibly other products, allows guest OS users to read from or write to arbitrary QEMU memory by modifying the address that is used by Cairo for memory mappings.
CVSS Score: 7.4 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2010-0271.html; https://bugzilla.redhat.com/show_bug.cgi?id=568702; https://rhn.redhat.com/errata/RHSA-2010-0476.html
CVE: CVE-2010-1819
Published: 2013-12-27
Description: Untrusted search path vulnerability in the Picture Viewer in Apple QuickTime before 7.6.8 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) CoreVideo.dll, (2) CoreGraphics.dll, or (3) CoreAudioToolbox.dll that is located in the same folder as a .pic image file.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010/Sep/msg00003.html; http://support.apple.com/kb/HT4339; http://www.fortiguard.com/advisory/FGA-2010-46/
CVE: CVE-2010-4174
Published: 2013-12-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-3282.  Reason: This candidate is a duplicate of CVE-2010-3282.  Notes: All CVE users should reference CVE-2010-3282 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-2519
Published: 2013-12-27
Description: Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2011-1212.html; http://www.openwall.com/lists/oss-security/2011/08/30/1; http://xenbits.xen.org/hg/xen-3.1-testing.hg/rev/15644
CVE: CVE-2013-2030
Published: 2013-12-27
Description: keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html; http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html; http://www.openwall.com/lists/oss-security/2013/05/09/2
CVE: CVE-2013-2179
Published: 2013-12-27
Description: X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117; http://lists.opensuse.org/opensuse-updates/2013-07/msg00002.html; http://www.openwall.com/lists/oss-security/2013/06/13/8
CVE: CVE-2013-1096
Published: 2013-12-28
Description: Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.novell.com/Download?buildid=dnDbmYe8PZc~; http://www.securitytracker.com/id/1029532; https://bugzilla.novell.com/show_bug.cgi?id=819115
CVE: CVE-2013-6006
Published: 2013-12-28
Description: Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN81706478/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000125; https://support.cybozu.com/ja-jp/article/7893
CVE: CVE-2013-6181
Published: 2013-12-28
Description: EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository, which allows local users to obtain sensitive information by leveraging repository privileges.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0140.html; http://packetstormsecurity.com/files/124585/EMC-Watch4net-Information-Disclosure.html; http://www.securityfocus.com/bid/64517
CVE: CVE-2013-6182
Published: 2013-12-28
Description: Unquoted Windows search path vulnerability in EMC Replication Manager before 5.5 allows local users to gain privileges via a crafted application in a parent directory of an intended directory.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0139.html; http://osvdb.org/101430; http://packetstormsecurity.com/files/124584/EMC-Replication-Manager-Unquoted-File-Path-Enumeration.html