deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6808
Published: 2013-12-28
Description: Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.zend.to/changelog.php; https://www.packetlabs.net/cve-2013-6808/; http://www.zend.to/changelog.php
CVE: CVE-2013-6812
Published: 2013-12-28
Description: The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/56279; https://nextdc.com/advisory/228; https://nextdc.com/advisory/cve/cve-2013-6812
CVE: CVE-2013-6886
Published: 2013-12-28
Description: RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) vncserver, (2) vncserver-x11, or (3) Xvnc helper.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.realvnc.com/products/vnc/documentation/5.0/release-notes/; http://www.realvnc.com/products/vnc/documentation/5.0/release-notes/
CVE: CVE-2013-6929
Published: 2013-12-28
Description: SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN60997973/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000124; https://support.cybozu.com/ja-jp/article/7889
CVE: CVE-2013-6932
Published: 2013-12-28
Description: Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN63194482/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000120; http://www.irfanview.com/main_history.htm
CVE: CVE-2013-6981
Published: 2013-12-28
Description: Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fragmented MPLS IP packets, aka Bug ID CSCul00709.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101423; http://secunia.com/advisories/56206; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6981
CVE: CVE-2013-7149
Published: 2013-12-28
Description: SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/; http://www.revive-adserver.com/security/REVIVE-SA-2013-001/; http://www.securityfocus.com/archive/1/530471/30/0/threaded
CVE: CVE-2013-2504
Published: 2013-12-29
Description: Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42 Service Store 5.3 SP3 (aka 5.33.946.0) allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0196.html; http://seclists.org/fulldisclosure/2013/Apr/153; http://archives.neohapsis.com/archives/bugtraq/2013-04/0196.html
CVE: CVE-2013-3846
Published: 2013-12-29
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CSpliceTreeEngine::InsertSplice object in an HTML document, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3143 and CVE-2013-3161.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.zerodayinitiative.com/advisories/ZDI-13-231/; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; http://www.zerodayinitiative.com/advisories/ZDI-13-231/
CVE: CVE-2013-5583
Published: 2013-12-29
Description: Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://disse.cting.org/2013/08/05/joomla-core-3_1_5_reflected-xss-vulnerability/; http://www.securityfocus.com/bid/61600; http://disse.cting.org/2013/08/05/joomla-core-3_1_5_reflected-xss-vulnerability/
CVE: CVE-2013-6189
Published: 2013-12-29
Description: Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, and 7.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1666.
CVSS Score: 10.0 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04041078; http://secunia.com/advisories/56263; http://www.securitytracker.com/id/1029542
CVE: CVE-2013-6197
Published: 2013-12-29
Description: Unspecified vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661 p8 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 5.2 (MEDIUM)
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04052075; http://www.securitytracker.com/id/1029541; https://exchange.xforce.ibmcloud.com/vulnerabilities/89974
CVE: CVE-2013-6198
Published: 2013-12-29
Description: Cross-site scripting (XSS) vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661 p8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04052075; http://www.securitytracker.com/id/1029541; https://exchange.xforce.ibmcloud.com/vulnerabilities/89975
CVE: CVE-2013-4858
Published: 2013-12-30
Description: Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a crafted .wav file, as demonstrated by movieMaker.wav.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://downloads.securityfocus.com/vulnerabilities/exploits/61334.py; http://www.securityfocus.com/bid/61334; http://downloads.securityfocus.com/vulnerabilities/exploits/61334.py
CVE: CVE-2013-5037
Published: 2013-12-30
Description: The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5038
Published: 2013-12-30
Description: The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5039
Published: 2013-12-30
Description: Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to hijack the authentication of administrators for requests that change the WiFi Security field to Deactivated via the WifiSecurity parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5210
Published: 2013-12-30
Description: Cross-site scripting (XSS) vulnerability in the GUI login page in ADTRAN AOS before R10.8.1 on the NetVanta 7100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://supportforums.adtran.com/docs/DOC-6414; https://supportforums.adtran.com/servlet/JiveServlet/downloadBody/6414-102-3-7862/NetVanta%207000%20Series%20Products%20AOS%20R10.8.1%20Release%20Notes.pdf; https://supportforums.adtran.com/docs/DOC-6414
CVE: CVE-2013-5218
Published: 2013-12-30
Description: Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp.
CVSS Score: 2.9 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5219
Published: 2013-12-30
Description: Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in a URI, as demonstrated by a request for /etc/passwd.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5220
Published: 2013-12-30
Description: goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device crash) via crafted HTTP POST data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html; http://www.youtube.com/watch?v=CPlT09ZIj48; http://packetstormsecurity.com/files/123901/HOTBOX-2.1.11-CSRF-Traversal-Denial-Of-Service.html
CVE: CVE-2013-5222
Published: 2013-12-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://support.esri.com/en/knowledgebase/techarticles/detail/41494; http://support.esri.com/en/knowledgebase/techarticles/detail/41498; http://support.esri.com/en/knowledgebase/techarticles/detail/41494
CVE: CVE-2013-7231
Published: 2013-12-30
Description: Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009; http://support.esri.com/en/knowledgebase/techarticles/detail/41468; http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009
CVE: CVE-2013-7232
Published: 2013-12-30
Description: SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009; http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009
CVE: CVE-2013-7233
Published: 2013-12-30
Description: Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2013/Dec/145; http://www.osvdb.org/101184; http://seclists.org/fulldisclosure/2013/Dec/145
CVE: CVE-2013-7209
Published: 2013-12-30
Description: Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101438; http://packetstormsecurity.com/files/124598/JForum-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2013/Dec/206
CVE: CVE-2013-6983
Published: 2013-12-31
Description: SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/101514; http://secunia.com/advisories/56273; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6983
CVE: CVE-2013-7241
Published: 2013-12-31
Description: Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2013/12/29/1; http://openwall.com/lists/oss-security/2013/12/30/10; http://seclists.org/bugtraq/2013/Oct/20
CVE: CVE-2013-7242
Published: 2013-12-31
Description: SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2013/12/29/1; http://openwall.com/lists/oss-security/2013/12/30/10; http://seclists.org/bugtraq/2013/Oct/20
CVE: CVE-2013-5573
Published: 2013-12-31
Description: Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124513; http://seclists.org/bugtraq/2013/Dec/104; http://seclists.org/fulldisclosure/2013/Dec/159
CVE: CVE-2013-6459
Published: 2013-12-31
Description: Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56180; http://www.securityfocus.com/bid/64509; https://access.redhat.com/errata/RHSA-2018:0336
CVE: CVE-2013-6987
Published: 2013-12-31
Description: Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi, (5) file_download.cgi, (6) file_sharing.cgi, (7) file_MVCP.cgi, or (8) file_rename.cgi in webapi/FileStation/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/124563; http://seclists.org/fulldisclosure/2013/Dec/177; http://www.exploit-db.com/exploits/30475
CVE: CVE-2012-0261
Published: 2013-12-31
Description: license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2012/Jan/62; http://secunia.com/advisories/47417; http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf
CVE: CVE-2012-0262
Published: 2013-12-31
Description: op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2012/Jan/62; http://secunia.com/advisories/47417; http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf
CVE: CVE-2012-0263
Published: 2013-12-31
Description: monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by (1) a malformed hoststatustypes parameter to status/service/all or (2) a crafted request to config.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2012/Jan/62; http://secunia.com/advisories/47344; http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf
CVE: CVE-2012-0264
Published: 2013-12-31
Description: op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2012/Jan/62; http://secunia.com/advisories/47344; http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf
CVE: CVE-2013-3572
Published: 2013-12-31
Description: Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://dl.ubnt.com/unifi/static/cve-2013-3572.html; http://spaceblogs.org/shackspace/2013/10/shackspace-hacker-finds-flaw-in-ubiquiti-networks-unifi-products/; http://www.securityfocus.com/bid/64601
CVE: CVE-2013-3667
Published: 2013-12-31
Description: The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://www.barebones.com/support/bbedit/arch_bbedit1055.html; http://www.barebones.com/support/textwrangler/notes_tw453.html; http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
CVE: CVE-2013-6450
Published: 2014-01-01
Description: The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=34628967f1e65dc8f34e000f0f5518e21afbfc7b; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
CVE: CVE-2011-5269
Published: 2014-01-02
Description: Cross-site scripting (XSS) vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.projectforge.org/pf-en/News; https://www.projectforge.org/jira/browse/PF-185; http://www.projectforge.org/pf-en/News
CVE: CVE-2013-3282
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-3283
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-3284
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-3289
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-5211
Published: 2014-01-02
Description: The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aix.software.ibm.com/aix/efixes/security/ntp_advisory.asc; http://bugs.ntp.org/show_bug.cgi?id=1532; http://ics-cert.us-cert.gov/advisories/ICSA-14-051-04
CVE: CVE-2013-5385
Published: 2014-01-02
Description: The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, formerly BLADE Operating System) does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1019716; http://www-01.ibm.com/support/docview.wss?uid=nas8N1010309; http://www.kb.cert.org/vuls/id/229804
CVE: CVE-2013-6179
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6183
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6184
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6185
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6186
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6187
Published: 2014-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none