deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3607
Published: 2013-09-08
Description: Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/648646; http://www.securityfocus.com/bid/62094; http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
CVE: CVE-2013-3608
Published: 2013-09-08
Description: The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allows remote authenticated users to execute arbitrary commands via shell metacharacters, as demonstrated by the IP address field in config_date_time.cgi.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/648646; http://www.securityfocus.com/bid/62097; http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
CVE: CVE-2013-3609
Published: 2013-09-08
Description: The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/648646; http://www.securityfocus.com/bid/62098; http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
CVE: CVE-2013-5132
Published: 2013-09-08
Description: Apple AirPort Base Station Firmware before 7.6.4 does not properly handle incorrect frame lengths, which allows remote attackers to cause a denial of service (device crash) by associating with the access point and then sending a short frame.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00000.html; http://support.apple.com/kb/HT5920; http://lists.apple.com/archives/security-announce/2013/Sep/msg00000.html
CVE: CVE-2013-5483
Published: 2013-09-08
Description: Cross-site scripting (XSS) vulnerability in bookmarklet.jsp in Cisco SocialMiner allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh73868.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5483; http://tools.cisco.com/security/center/viewAlert.x?alertId=30674; http://www.securityfocus.com/bid/62252
CVE: CVE-2013-0531
Published: 2013-09-08
Description: The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640352; https://exchange.xforce.ibmcloud.com/vulnerabilities/84707; http://www-01.ibm.com/support/docview.wss?uid=swg21640352
CVE: CVE-2013-2997
Published: 2013-09-08
Description: IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation.
CVSS Score: 1.7 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640352; https://exchange.xforce.ibmcloud.com/vulnerabilities/84066; http://www-01.ibm.com/support/docview.wss?uid=swg21640352
CVE: CVE-2013-3596
Published: 2013-09-08
Description: AdvancePro Advanceware allows remote authenticated users to obtain sensitive information about arbitrary customers' orders via a modified id parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/96801; http://www.kb.cert.org/vuls/id/704526; http://osvdb.org/96801
CVE: CVE-2013-3031
Published: 2013-09-09
Description: A SQL stored procedure in the Universal Cache component in IBM solidDB 6.0.x before 6.0.1070, 6.3.x before 6.3.0.56, 6.5.x before 6.5.0.12, and 7.0.x before 7.0.0.4 allows remote authenticated users to cause a denial of service (uninitialized-memory access and daemon crash) via a call that includes named arguments and default parameter values, but does not include all of the expected arguments.
CVSS Score: 3.5 (LOW)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC88796; http://www-01.ibm.com/support/docview.wss?uid=swg1IC88797; http://www-01.ibm.com/support/docview.wss?uid=swg1IC94043
CVE: CVE-2013-4061
Published: 2013-09-09
Description: IBM Rational Policy Tester 8.5 before 8.5.0.5 does not properly check authorization for changes to the set of authentication hosts, which allows remote authenticated users to perform spoofing attacks involving an HTTP redirect via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648481; https://exchange.xforce.ibmcloud.com/vulnerabilities/86585; http://www-01.ibm.com/support/docview.wss?uid=swg21648481
CVE: CVE-2013-4062
Published: 2013-09-09
Description: IBM Rational Policy Tester 8.5 before 8.5.0.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof Jazz Team servers, obtain sensitive information, and modify the client-server data stream via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648481; https://exchange.xforce.ibmcloud.com/vulnerabilities/86586; http://www-01.ibm.com/support/docview.wss?uid=swg21648481
CVE: CVE-2013-2791
Published: 2013-09-09
Description: MatrikonOPC SCADA DNP3 OPC Server 1.2.0 allows remote attackers to cause a denial of service (master-station daemon crash) via a malformed DNP3 TCP packet from the IP address of an outstation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-213-04A; http://www.opcsupport.com/ics/support/KBAnswer.asp?questionID=2890; http://ics-cert.us-cert.gov/advisories/ICSA-13-213-04A
CVE: CVE-2013-2793
Published: 2013-09-09
Description: Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01; http://www.trianglemicroworks.com/documents/mdnp_scl_whats_new.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01
CVE: CVE-2013-2794
Published: 2013-09-09
Description: Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01; http://www.trianglemicroworks.com/documents/mdnp_scl_whats_new.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01
CVE: CVE-2013-2803
Published: 2013-09-09
Description: ProSoft RadioLinx ControlScape before 6.00.040 uses a deficient PRNG algorithm and seeding strategy for passphrases, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-248-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-248-01
CVE: CVE-2013-2992
Published: 2013-09-09
Description: The Search component in IBM WebSphere Commerce 7.0 FP4 through FP6, in certain search-term association configurations, allows remote attackers to cause a denial of service via a crafted query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR46013; http://www-01.ibm.com/support/docview.wss?uid=swg1JR47273; http://www-01.ibm.com/support/docview.wss?uid=swg1JR47295
CVE: CVE-2013-4899
Published: 2013-09-09
Description: Cross-site scripting (XSS) vulnerability in Twilight CMS 5.17 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the gallery/ page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0128.html; http://secunia.com/advisories/54404; https://www.htbridge.com/advisory/HTB23166
CVE: CVE-2013-4900
Published: 2013-09-09
Description: Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote attackers to read arbitrary files via a ..%5c (dot dot encoded backslash) in a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0126.html; http://secunia.com/advisories/54404; http://www.exploit-db.com/exploits/27777
CVE: CVE-2013-5641
Published: 2013-09-09
Description: The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0175.html; http://downloads.asterisk.org/pub/security/AST-2013-004.html; http://osvdb.org/96691
CVE: CVE-2013-5642
Published: 2013-09-09
Description: The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0174.html; http://downloads.asterisk.org/pub/security/AST-2013-005.html; http://osvdb.org/96690
CVE: CVE-2013-5714
Published: 2013-09-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0153.html; http://osvdb.org/96593; http://secunia.com/advisories/54619
CVE: CVE-2013-5715
Published: 2013-09-09
Description: Buffer overflow in Gretech GOM Media Player before 2.2.53.5169 has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://player.gomlab.com/eng/download/; http://player.gomlab.com/eng/notice/view.gom?intseq=239; http://player.gomlab.com/eng/download/
CVE: CVE-2013-5716
Published: 2013-09-09
Description: Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (application crash) via a crafted WAV file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/28080; http://www.securityfocus.com/bid/62173; http://www.exploit-db.com/exploits/28080
CVE: CVE-2013-3657
Published: 2013-09-10
Description: Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN19847770/995428/index.html; http://jvn.jp/en/jp/JVN19847770/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000085
CVE: CVE-2013-3658
Published: 2013-09-10
Description: Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN72911629/995428/index.html; http://jvn.jp/en/jp/JVN72911629/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000084
CVE: CVE-2013-4703
Published: 2013-09-10
Description: Cross-site scripting (XSS) vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20130909up11.php; http://jvn.jp/en/jp/JVN53014207/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000082
CVE: CVE-2013-4983
Published: 2013-09-10
Description: The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities; http://www.sophos.com/en-us/support/knowledgebase/119773.aspx; http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities
CVE: CVE-2013-4984
Published: 2013-09-10
Description: The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-264
References: http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities; http://www.sophos.com/en-us/support/knowledgebase/119773.aspx; http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities
CVE: CVE-2013-5700
Published: 2013-09-10
Description: The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted sequence of messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: https://bitcointalk.org/index.php?topic=287351; https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures; https://bitcointalk.org/index.php?topic=287351
CVE: CVE-2013-3934
Published: 2013-09-10
Description: Stack-based buffer overflow in Kingsoft Writer 2012 8.1.0.3030, as used in Kingsoft Office 2013 before 9.1.0.4256, allows remote attackers to execute arbitrary code via a long font name in a WPS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/53266; http://www.securityfocus.com/bid/61796; http://www.securitytracker.com/id/1028920
CVE: CVE-2013-4169
Published: 2013-09-10
Description: GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2013-1213.html; http://secunia.com/advisories/54661; https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=988498
CVE: CVE-2013-4232
Published: 2013-09-10
Description: Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.maptools.org/show_bug.cgi?id=2449; http://rhn.redhat.com/errata/RHSA-2014-0223.html; http://secunia.com/advisories/54543
CVE: CVE-2013-4243
Published: 2013-09-10
Description: Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2451; http://rhn.redhat.com/errata/RHSA-2014-0223.html; http://secunia.com/advisories/54543
CVE: CVE-2013-4283
Published: 2013-09-10
Description: ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://directory.fedoraproject.org/wiki/Releases/1.3.0.8; http://rhn.redhat.com/errata/RHSA-2013-1182.html; http://secunia.com/advisories/54586
CVE: CVE-2013-4298
Published: 2013-09-10
Description: The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721273; http://secunia.com/advisories/54581; http://secunia.com/advisories/54671
CVE: CVE-2013-5672
Published: 2013-09-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0006.html; http://osvdb.org/96792; http://packetstormsecurity.com/files/123036
CVE: CVE-2013-5673
Published: 2013-09-10
Description: SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0006.html; http://osvdb.org/96793; http://packetstormsecurity.com/files/123036
CVE: CVE-2013-0081
Published: 2013-09-11
Description: Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL, aka "SharePoint Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19036
CVE: CVE-2013-0810
Published: 2013-09-11
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-071; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18579
CVE: CVE-2013-1315
Published: 2013-09-11
Description: Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073
CVE: CVE-2013-1330
Published: 2013-09-11
Description: The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105
CVE: CVE-2013-1341
Published: 2013-09-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-076; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18660
CVE: CVE-2013-1342
Published: 2013-09-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1343, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-076; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18714
CVE: CVE-2013-1343
Published: 2013-09-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-253A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-076; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18551