deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1797
Published: 2013-03-22
Description: Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b79459b482e85cb7426aa7da683a9f2c97aeae1; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2013-1798
Published: 2013-03-22
Description: The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2c118bfab8bc6b8bb213abfc35201e441693d55; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2013-1826
Published: 2013-03-22
Description: The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 6.2 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=864745d291b5ba80ea0bd0edcbe67273de368836; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.7
CVE: CVE-2013-1827
Published: 2013-03-22
Description: net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
CVSS Score: 6.2 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=276bdb82dedb290511467a5a4fdbe9f0b52dce6f; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4
CVE: CVE-2013-1828
Published: 2013-03-22
Description: The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=726bc6b092da4c093eb74d13c07184b18c1af0f1; http://grsecurity.net/~spender/sctp.c; http://twitter.com/grsecurity/statuses/[PII_REDACTED]49541376
CVE: CVE-2013-1848
Published: 2013-03-22
Description: fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d0c2d10dd72c5292eda7a06231056a4c972e4cc; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html; http://rhn.redhat.com/errata/RHSA-2013-0928.html
CVE: CVE-2013-1860
Published: 2013-03-22
Description: Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c0f5ecee4e741667b2493c742b60b6218d40b3aa; http://rhn.redhat.com/errata/RHSA-2014-0328.html; http://rhn.redhat.com/errata/RHSA-2014-0339.html
CVE: CVE-2013-1873
Published: 2013-03-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2634, CVE-2013-2635, CVE-2013-2636. Reason: This candidate is a duplicate of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636. Notes: All CVE users should reference one or more of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2013-2634
Published: 2013-03-22
Description: net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=29cd8ae0e1a39e239a3a7b67da1986add1199fc0; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
CVE: CVE-2013-2635
Published: 2013-03-22
Description: The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=84d73cd3fb142bf1298a8c13fd4ca50fd2432372; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
CVE: CVE-2013-2636
Published: 2013-03-22
Description: net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c085c49920b2f900ba716b4ca1c1a55ece9872cc; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4; http://www.openwall.com/lists/oss-security/2013/03/20/1
CVE: CVE-2013-0731
Published: 2013-03-22
Description: ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/91274; http://plugins.trac.wordpress.org/changeset?new=682420; http://secunia.com/advisories/51917
CVE: CVE-2013-2640
Published: 2013-03-22
Description: ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/91274; http://plugins.trac.wordpress.org/changeset?new=682420; http://secunia.com/advisories/51917
CVE: CVE-2013-0335
Published: 2013-03-22
Description: OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0709.html; http://secunia.com/advisories/52337; http://secunia.com/advisories/52728
CVE: CVE-2013-1838
Published: 2013-03-22
Description: OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/91303; http://rhn.redhat.com/errata/RHSA-2013-0709.html; http://secunia.com/advisories/52580
CVE: CVE-2013-1840
Published: 2013-03-22
Description: The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://osvdb.org/91304; http://rhn.redhat.com/errata/RHSA-2013-0707.html; http://secunia.com/advisories/52565
CVE: CVE-2013-1865
Published: 2013-03-22
Description: OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00000.html; http://osvdb.org/91532
CVE: CVE-2013-2501
Published: 2013-03-22
Description: Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0055.html; http://osvdb.org/91123; http://packetstormsecurity.com/files/120730/WordPress-Terillion-Reviews-Cross-Site-Scripting.html
CVE: CVE-2013-1829
Published: 2013-03-25
Description: calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37338; http://openwall.com/lists/oss-security/2013/03/25/2; https://moodle.org/mod/forum/discuss.php?d=225339
CVE: CVE-2013-1830
Published: 2013-03-25
Description: user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1831
Published: 2013-03-25
Description: lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36901; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1832
Published: 2013-03-25
Description: repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37681; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1833
Published: 2013-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37507; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1834
Published: 2013-03-25
Description: notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37411; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1835
Published: 2013-03-25
Description: Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36426; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1836
Published: 2013-03-25
Description: Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37852; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
CVE: CVE-2013-1161
Published: 2013-03-26
Description: The XML parser in the Cisco Jabber IM application for Android allows remote authenticated users to cause a denial of service (blocked connection) by leveraging an entry on a Buddy list and sending a crafted XMPP presence update message, aka Bug ID CSCue38383.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1161; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1161
CVE: CVE-2013-1162
Published: 2013-03-26
Description: The traffic engineering (TE) processing subsystem in Cisco IOS XR allows remote attackers to cause a denial of service (process restart) via crafted TE packets, aka Bug ID CSCue04000.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1162; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1162
CVE: CVE-2013-1608
Published: 2013-03-26
Description: Directory traversal vulnerability in the Management Console on the Symantec NetBackup (NBU) appliance 2.0.x allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/58542; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130320_00; http://www.securityfocus.com/bid/58542
CVE: CVE-2013-1609
Published: 2013-03-26
Description: Multiple unquoted Windows search path vulnerabilities in the (1) File Collector and (2) File PlaceHolder services in Symantec Enterprise Vault (EV) for File System Archiving before 9.0.4 and 10.x before 10.0.1 allow local users to gain privileges via a Trojan horse program.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/58617; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130321_00; http://www.securityfocus.com/bid/58617
CVE: CVE-2012-5943
Published: 2013-03-26
Description: Cross-site scripting (XSS) vulnerability in IBM iNotes 8.5.x before 8.5.3 FP4 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving mail, aka SPR JDOE8ZZS9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21628658; https://exchange.xforce.ibmcloud.com/vulnerabilities/80538; http://www-01.ibm.com/support/docview.wss?uid=swg21628658
CVE: CVE-2013-0454
Published: 2013-03-26
Description: The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1004289; http://www.ubuntu.com/usn/USN-1802-1; https://bugzilla.redhat.com/show_bug.cgi?id=928419
CVE: CVE-2013-0525
Published: 2013-03-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a shared mail file, aka SPR DKEN8PDNTX.
CVSS Score: 1.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21628658; https://exchange.xforce.ibmcloud.com/vulnerabilities/82542; http://www-01.ibm.com/support/docview.wss?uid=swg21628658
CVE: CVE-2013-0486
Published: 2013-03-27
Description: Memory leak in the HTTP server in IBM Domino 8.5.x allows remote attackers to cause a denial of service (memory consumption and daemon crash) via GET requests, aka SPR KLYH92NKZY.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN51305555/index.html; http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000030.html; http://www-01.ibm.com/support/docview.wss?uid=swg21627597
CVE: CVE-2013-0487
Published: 2013-03-27
Description: The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21627597; https://exchange.xforce.ibmcloud.com/vulnerabilities/81852; http://www-01.ibm.com/support/docview.wss?uid=swg21627597
CVE: CVE-2013-0488
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21627597; https://exchange.xforce.ibmcloud.com/vulnerabilities/81853; http://www-01.ibm.com/support/docview.wss?uid=swg21627597
CVE: CVE-2013-0489
Published: 2013-03-27
Description: Cross-site request forgery (CSRF) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote authenticated users to hijack the authentication of administrators.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21627597; https://exchange.xforce.ibmcloud.com/vulnerabilities/81854; http://www-01.ibm.com/support/docview.wss?uid=swg21627597
CVE: CVE-2013-0718
Published: 2013-03-27
Description: The Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN77360971/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000029; http://jvn.jp/en/jp/JVN77360971/index.html
CVE: CVE-2013-0719
Published: 2013-03-27
Description: The ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN80922020/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000026; http://jvn.jp/en/jp/JVN80922020/index.html
CVE: CVE-2013-0720
Published: 2013-03-27
Description: The COBIME application before 0.9.4 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN11249169/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000027; http://jvn.jp/en/jp/JVN11249169/index.html
CVE: CVE-2013-2300
Published: 2013-03-27
Description: The FlickWnn (aka OpenWnn/Flick support) application 2.02 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN11434157/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000028; http://jvn.jp/en/jp/JVN11434157/index.html
CVE: CVE-2013-0181
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupalcode.org/project/search_api.git/commitdiff/35b5728; http://osvdb.org/89117; http://secunia.com/advisories/51806
CVE: CVE-2013-0182
Published: 2013-03-27
Description: The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1871508; http://drupal.org/node/1883830; http://drupalcode.org/project/payment.git/commitdiff/62c9186
CVE: CVE-2013-0257
Published: 2013-03-27
Description: The email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes, which allows remote attackers to read images of user email addresses and email fields.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1903264; http://www.openwall.com/lists/oss-security/2013/02/05/1; http://drupal.org/node/1903264
CVE: CVE-2013-0258
Published: 2013-03-27
Description: The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://drupal.org/node/1902102; http://drupal.org/node/1903282; http://drupalcode.org/project/ga_login.git/commitdiff/50b032d