deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4546
Published: 2013-04-03
Description: The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://rhn.redhat.com/errata/RHSA-2013-0528.html; http://rhn.redhat.com/errata/RHSA-2013-0528.html
CVE: CVE-2012-6129
Published: 2013-04-03
Description: Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00064.html; http://www.openwall.com/lists/oss-security/2013/02/13/1; http://www.ubuntu.com/usn/USN-1747-1
CVE: CVE-2013-0278
Published: 2013-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-0279
Published: 2013-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-0280
Published: 2013-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1664
Published: 2013-04-03
Description: The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html; http://bugs.python.org/issue17239; http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
CVE: CVE-2013-1665
Published: 2013-04-03
Description: The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html; http://bugs.python.org/issue17239; http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
CVE: CVE-2013-1911
Published: 2013-04-03
Description: lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html; http://osvdb.org/91870; http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html
CVE: CVE-2013-0788
Published: 2013-04-03
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0789
Published: 2013-04-03
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsContentUtils::HoldJSObjects function and the nsAutoPtr class, and other vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0790
Published: 2013-04-03
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox before 20.0 on Android allows remote attackers to cause a denial of service (stack memory corruption and application crash) or possibly execute arbitrary code via unknown vectors involving a plug-in.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html; http://www.mozilla.org/security/announce/2013/mfsa2013-30.html; https://bugzilla.mozilla.org/show_bug.cgi?id=842687
CVE: CVE-2013-0791
Published: 2013-04-03
Description: The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html
CVE: CVE-2013-0792
Published: 2013-04-03
Description: Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a grayscale PNG image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0793
Published: 2013-04-03
Description: Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0794
Published: 2013-04-03
Description: Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0795
Published: 2013-04-03
Description: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0796
Published: 2013-04-03
Description: The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (free of unallocated memory) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0797
Published: 2013-04-03
Description: Untrusted search path vulnerability in the Mozilla Updater in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allows local users to gain privileges via a Trojan horse DLL file in an unspecified directory.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html; http://www.mozilla.org/security/announce/2013/mfsa2013-34.html
CVE: CVE-2013-0798
Published: 2013-04-03
Description: Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which app_tmp is used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html; http://www.mozilla.org/security/announce/2013/mfsa2013-33.html; https://bugzilla.mozilla.org/show_bug.cgi?id=844832
CVE: CVE-2013-0799
Published: 2013-04-03
Description: Buffer overflow in the Mozilla Maintenance Service in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, and Thunderbird ESR 17.x before 17.0.5 on Windows allows local users to gain privileges via crafted arguments.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html; http://www.mozilla.org/security/announce/2013/mfsa2013-32.html
CVE: CVE-2013-0800
Published: 2013-04-03
Description: Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
CVE: CVE-2013-0663
Published: 2013-04-04
Description: Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf; http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/; http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper
CVE: CVE-2013-0664
Published: 2013-04-04
Description: The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests.
CVSS Score: 8.5 (HIGH)
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf; http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/; http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper
CVE: CVE-2013-2761
Published: 2013-04-04
Description: The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as demonstrated by the FileZilla FTP client.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/; http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper; http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/
CVE: CVE-2013-2762
Published: 2013-04-04
Description: The Schneider Electric Magelis XBT HMI controller has a default password for authentication of configuration uploads, which makes it easier for remote attackers to bypass intended access restrictions via crafted configuration data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255, CWE-352
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf
CVE: CVE-2013-2763
Published: 2013-04-04
Description: The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors.  NOTE: the vendor reportedly disputes this issue because it "could not be duplicated" and "an attacker could not remotely exploit this observed behavior to deny PLC control functions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf
CVE: CVE-2012-4710
Published: 2013-04-04
Description: Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-067-02.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-067-02.pdf
CVE: CVE-2013-1899
Published: 2013-04-04
Description: Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
CVE: CVE-2013-1900
Published: 2013-04-04
Description: PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
CVE: CVE-2013-1901
Published: 2013-04-04
Description: PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
CVE: CVE-2013-1902
Published: 2013-04-04
Description: PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.postgresql.org/about/news/1456/; http://www.postgresql.org/support/security/
CVE: CVE-2013-1903
Published: 2013-04-04
Description: PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.postgresql.org/about/news/1456/; http://www.postgresql.org/support/security/
CVE: CVE-2013-0125
Published: 2013-04-04
Description: Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/418923; http://www.kb.cert.org/vuls/id/418923
CVE: CVE-2013-0128
Published: 2013-04-04
Description: The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/704916; http://www.kb.cert.org/vuls/id/704916
CVE: CVE-2013-2302
Published: 2013-04-04
Description: TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitrary users by leveraging shell access, as demonstrated by a TELNET or SSH session to the server.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN04288738/458182/index.html; http://jvn.jp/en/jp/JVN04288738/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000031
CVE: CVE-2013-0470
Published: 2013-04-05
Description: HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-16
References: http://www-01.ibm.com/support/docview.wss?uid=swg21631945; https://exchange.xforce.ibmcloud.com/vulnerabilities/81336; http://www-01.ibm.com/support/docview.wss?uid=swg21631945
CVE: CVE-2013-0483
Published: 2013-04-05
Description: The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21631537; https://exchange.xforce.ibmcloud.com/vulnerabilities/81533; http://www-01.ibm.com/support/docview.wss?uid=swg21631537
CVE: CVE-2013-1174
Published: 2013-04-05
Description: Cisco Tivoli Business Service Manager (TBSM) in Hosted Collaboration Mediation (HCM) in Cisco Hosted Collaboration Solution allows remote attackers to cause a denial of service (temporary service hang) by sending many TCP packets to certain ports, aka Bug ID CSCue03703.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1174; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1174
CVE: CVE-2013-0680
Published: 2013-04-05
Description: Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf
CVE: CVE-2013-0681
Published: 2013-04-05
Description: Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed data in a formatted text command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf
CVE: CVE-2013-0682
Published: 2013-04-05
Description: Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 do not properly handle exceptions, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command, leading to out-of-bounds access to (1) heap or (2) stack memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf
CVE: CVE-2013-0683
Published: 2013-04-05
Description: The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service (incorrect pointer access and client crash) via malformed data in a formatted text command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf