deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1699
Published: 2013-06-26
Description: The Internationalized Domain Name (IDN) display algorithm in Mozilla Firefox before 22.0 does not properly handle the .com, .name, and .net top-level domains, which allows remote attackers to spoof the address bar via unspecified homograph characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html; http://www.mozilla.org/security/announce/2013/mfsa2013-61.html; http://www.ubuntu.com/usn/USN-1890-1
CVE: CVE-2013-1700
Published: 2013-06-26
Description: The Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly handle inability to launch the Mozilla Updater executable file, which allows local users to gain privileges via vectors involving placement of a Trojan horse executable file at an arbitrary location.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.mozilla.org/security/announce/2013/mfsa2013-62.html; https://bugzilla.mozilla.org/show_bug.cgi?id=867056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126
CVE: CVE-2013-3382
Published: 2013-06-26
Description: The Next-Generation Firewall (aka NGFW, formerly CX Context-Aware Security) module 9.x before 9.1.1.9 and 9.1.2.x before 9.1.2.12 for Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (device reload or traffic-processing outage) via fragmented (1) IPv4 or (2) IPv6 traffic, aka Bug ID CSCue88387.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-ngfw; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-ngfw
CVE: CVE-2013-3393
Published: 2013-06-26
Description: The Precision Video Engine component in Cisco Jabber for Windows and Cisco Virtualization Experience Media Engine allows remote attackers to cause a denial of service (process crash and call disconnection) via crafted RTP packets, aka Bug IDs CSCuh60706 and CSCue21117.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3393; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3393
CVE: CVE-2013-3396
Published: 2013-06-26
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance (SMA) devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3396; http://www.securityfocus.com/bid/60829; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3396
CVE: CVE-2013-3397
Published: 2013-06-26
Description: Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability component in Cisco Unified Communications Manager (CUCM) allows remote attackers to hijack the authentication of arbitrary users for requests that perform Unified Serviceability actions, aka Bug ID CSCuh10298.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3397; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3397
CVE: CVE-2013-3398
Published: 2013-06-26
Description: The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance provides different responses to requests for arbitrary pathnames depending on whether the pathname exists, which allows remote attackers to enumerate directories and files via a series of crafted requests, aka Bug ID CSCuh64574.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3398; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3398
CVE: CVE-2012-6574
Published: 2013-06-27
Description: Cross-site scripting (XSS) vulnerability in the Fonecta verify module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers from certain sources to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/55614; https://drupal.org/node/1778782; https://drupal.org/node/1789258
CVE: CVE-2012-6575
Published: 2013-06-27
Description: Cross-site scripting (XSS) vulnerability in the Exposed Filter Data module 6.x-1.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/85190; https://drupal.org/node/1774636; https://drupal.org/node/1775582
CVE: CVE-2012-6576
Published: 2013-06-27
Description: Cross-site scripting (XSS) vulnerability in the PRH Search module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers from certain sources to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/50672; https://drupal.org/node/1778778; https://drupal.org/node/1789252
CVE: CVE-2012-6577
Published: 2013-06-27
Description: SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/formhandler; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-012/; https://exchange.xforce.ibmcloud.com/vulnerabilities/79670
CVE: CVE-2013-4719
Published: 2013-06-27
Description: SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/53283; http://typo3.org/extensions/repository/view/lonewsseo; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/
CVE: CVE-2013-4720
Published: 2013-06-27
Description: SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90413; http://typo3.org/extensions/repository/view/wec_discussion; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/
CVE: CVE-2013-4721
Published: 2013-06-27
Description: SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90411; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/; https://exchange.xforce.ibmcloud.com/vulnerabilities/82218
CVE: CVE-2011-1181
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2011-4145
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4146
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4147
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4148
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4149
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4150
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2012-3573
Published: 2013-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2013-3383
Published: 2013-06-27
Description: The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4, aka Bug ID CSCzv69294.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa
CVE: CVE-2013-3384
Published: 2013-06-27
Description: The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110, 7.7 before 7.7.0-213, and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL, aka Bug IDs CSCzv85726, CSCzv44633, and CSCzv24579.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa
CVE: CVE-2013-3385
Published: 2013-06-27
Description: The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers to cause a denial of service (system hang) via a series of (1) HTTP or (2) HTTPS requests to a management interface, aka Bug IDs CSCzv58669, CSCzv63329, and CSCzv78669.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa
CVE: CVE-2013-3386
Published: 2013-06-27
Description: The IronPort Spam Quarantine (ISQ) component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019 and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers to cause a denial of service (service crash or hang) via a high rate of TCP connection attempts, aka Bug IDs CSCzv25573 and CSCzv81712.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa
CVE: CVE-2013-2322
Published: 2013-06-28
Description: HP SQL/MX 3.2 and earlier on NonStop servers, when SQL/MP Objects are used, allows remote authenticated users to obtain sensitive information via unspecified vectors, aka the "SQL/MP index" issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03762155; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03762155
CVE: CVE-2013-2323
Published: 2013-06-28
Description: HP SQL/MX 3.0 through 3.2 on NonStop servers, when SQL/MP Objects are used, allows remote authenticated users to bypass intended access restrictions and modify data via unspecified vectors, aka the "SQL/MP tables" issue.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03762155; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03762155
CVE: CVE-2013-4660
Published: 2013-06-28
Description: The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://portal.nodesecurity.io/advisories/js-yaml; https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/; http://portal.nodesecurity.io/advisories/js-yaml
CVE: CVE-2010-5288
Published: 2013-06-28
Description: Buffer overflow in the lsConnectionCached function in editcp in EDItran Communications Platform 4.1 R7 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 7777.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/40395; http://www.digitalsec.net/stuff/explt+advs/editcpv4.1R7_bof.txt; http://secunia.com/advisories/40395
CVE: CVE-2013-3648
Published: 2013-06-28
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN26394323/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000066; http://www.kent-web.com/mail/postmail.html
CVE: CVE-2013-3649
Published: 2013-06-28
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN85804149/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000067; http://www.kent-web.com/mail/clipmail.html
CVE: CVE-2013-4091
Published: 2013-06-28
Description: The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 does not have an off autocomplete attribute for the password (aka j_password) field on the secsphLogin.jsp login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt; http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html
CVE: CVE-2013-4092
Published: 2013-06-28
Description: The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent attackers to obtain sensitive information by leveraging the presence of (1) a session ID in the jsessionid field to secsphLogin.jsp or (2) credentials in the j_password parameter to j_acegi_security_check, and reading (a) web-server access logs, (b) web-server Referer logs, or (c) the browser history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt; http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html
CVE: CVE-2013-4093
Published: 2013-06-28
Description: The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via (1) a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path in the s0.filePath field, or (2) a T/keyManagement request to plain/settings.html, which reveals a temporary path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt; http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html
CVE: CVE-2013-4094
Published: 2013-06-28
Description: The Key Management feature in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the (1) private_key or (2) public_key parameter in a T/keyManagement request to plain/settings.html, as demonstrated by uploading a Linux ELF file and a shell script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt; http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html
CVE: CVE-2013-4095
Published: 2013-06-28
Description: plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to execute arbitrary commands via a task with a [command].value field in conjunction with an [arguments].value field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt; http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html
CVE: CVE-2013-4096
Published: 2013-06-28
Description: ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary commands via shell metacharacters in the HOST_NAME field.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt; http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html
CVE: CVE-2013-4097
Published: 2013-06-28
Description: ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in a -REG-E-OPEN error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt; http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html
CVE: CVE-2013-4098
Published: 2013-06-28
Description: ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html; http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt; http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html
CVE: CVE-2013-2339
Published: 2013-06-30
Description: HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client, t410 Smart Zero Client, t510 Flexible Thin Client, t5565z Smart Client, t610 Flexible Thin Client, and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03757330; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03757330
CVE: CVE-2013-2342
Published: 2013-06-30
Description: The HP StoreOnce D2D backup system with software before 3.0.0 has a default password of badg3r5 for the HPSupport account, which allows remote attackers to obtain administrative access and delete data via an SSH session.
CVSS Score: 7.7 (HIGH)
CWE: CWE-255
References: http://www.lolware.net/hpstorage.html; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03813919; http://www.lolware.net/hpstorage.html
CVE: CVE-2013-3650
Published: 2013-06-30
Description: Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN43886811/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000061; http://svn.ec-cube.net/open_trac/changeset/22863
CVE: CVE-2013-3651
Published: 2013-06-30
Description: LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN34900750/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000062; http://svn.ec-cube.net/open_trac/changeset/22891
CVE: CVE-2013-3654
Published: 2013-06-30
Description: Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN04161229/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000065; http://svn.ec-cube.net/open_trac/changeset/22891
CVE: CVE-2013-0137
Published: 2013-06-30
Description: The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf; http://www.kb.cert.org/vuls/id/662676; http://www.kb.cert.org/vuls/id/AAMN-98MU7H
CVE: CVE-2013-4731
Published: 2013-06-30
Description: ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tag_ipPing request, a different vulnerability than CVE-2013-3581.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/932044; http://www.kb.cert.org/vuls/id/932044