deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0233
Published: 2013-04-25
Description: Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/; http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html; http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset
CVE: CVE-2013-0338
Published: 2013-04-25
Description: libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html
CVE: CVE-2013-1915
Published: 2013-04-25
Description: ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html
CVE: CVE-2013-1933
Published: 2013-04-25
Description: The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://osvdb.org/92117; http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html; http://www.openwall.com/lists/oss-security/2013/04/08/15
CVE: CVE-2013-1947
Published: 2013-04-25
Description: kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2013/04/10/3; http://www.openwall.com/lists/oss-security/2013/04/12/2; http://www.openwall.com/lists/oss-security/2013/04/10/3
CVE: CVE-2013-1948
Published: 2013-04-25
Description: converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/92290; http://vapid.dhs.org/advisories/md2pdf-remote-exec.html; http://www.securityfocus.com/bid/59061
CVE: CVE-2013-1949
Published: 2013-04-25
Description: Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.sucuri.net/2013/04/wordpress-plugin-social-media-widget.html; http://it.slashdot.org/story/13/04/13/212226/popular-wordpress-plug-in-caught-spamming-is-put-on-probation; http://securityledger.com/hacked-wordpress-plug-in-put-on-double-secret-probation/
CVE: CVE-2013-1969
Published: 2013-04-25
Description: Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00109.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00081.html; http://secunia.com/advisories/53061
CVE: CVE-2013-1970
Published: 2013-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-1969.  Reason: This candidate is a duplicate of CVE-2013-1969.  Notes: All CVE users should reference CVE-2013-1969 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3238
Published: 2013-04-26
Description: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
CVSS Score: 6.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html
CVE: CVE-2013-3239
Published: 2013-04-26
Description: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html
CVE: CVE-2013-3240
Published: 2013-04-26
Description: Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html; http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php; http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html
CVE: CVE-2013-3241
Published: 2013-04-26
Description: export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.
CVSS Score: 4.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html; http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php; http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html
CVE: CVE-2012-5220
Published: 2013-04-26
Description: Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03570121-2; http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03570121-2
CVE: CVE-2013-0727
Published: 2013-04-26
Description: Multiple untrusted search path vulnerabilities in Global Mapper 14.1.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .gmc, .gmg, .gmp, .gms, .gmw, or .opt file.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/51510; http://secunia.com/advisories/51510
CVE: CVE-2013-2306
Published: 2013-04-26
Description: The jigbrowser+ application before 1.6.4 for Android does not properly open windows, which allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN01313594/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000036; https://play.google.com/store/apps/details?id=jp.jig.product.browser_plus
CVE: CVE-2013-2307
Published: 2013-04-26
Description: The Yahoo! Browser application before 1.4.3 for Android allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN55074201/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000037; https://play.google.com/store/apps/details?id=jp.co.yahoo.android.ybrowser
CVE: CVE-2013-2709
Published: 2013-04-26
Description: Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53151; http://wordpress.org/extend/plugins/foursquare-checkins/changelog/; http://secunia.com/advisories/53151
CVE: CVE-2013-1428
Published: 2013-04-26
Description: Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://freecode.com/projects/tinc/releases/354122; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105531.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105559.html
CVE: CVE-2013-0569
Published: 2013-04-27
Description: Cross-site scripting (XSS) vulnerability in the Communities component in IBM Connections 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO74629; http://www-01.ibm.com/support/docview.wss?uid=swg21635059; https://exchange.xforce.ibmcloud.com/vulnerabilities/83354
CVE: CVE-2013-0571
Published: 2013-04-27
Description: Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 2.9 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635328; https://exchange.xforce.ibmcloud.com/vulnerabilities/83246; http://www-01.ibm.com/support/docview.wss?uid=swg21635328
CVE: CVE-2013-0572
Published: 2013-04-27
Description: Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.
CVSS Score: 2.3 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635328; https://exchange.xforce.ibmcloud.com/vulnerabilities/83247; http://www-01.ibm.com/support/docview.wss?uid=swg21635328
CVE: CVE-2013-0593
Published: 2013-04-27
Description: Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635503; https://exchange.xforce.ibmcloud.com/vulnerabilities/83382; http://www-01.ibm.com/support/docview.wss?uid=swg21635503
CVE: CVE-2012-5219
Published: 2013-04-28
Description: Cross-site scripting (XSS) vulnerability in HP Managed Printing Administration (MPA) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03737200; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03737200
CVE: CVE-2013-0533
Published: 2013-04-28
Description: Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21633620; https://exchange.xforce.ibmcloud.com/vulnerabilities/82655; http://www-01.ibm.com/support/docview.wss?uid=swg21633620
CVE: CVE-2013-0553
Published: 2013-04-28
Description: The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced Connect client, Sametime Advanced Web client, and other products, allows remote authenticated users to send commands to individual chat users, or to all participants in a chat room, via a crafted Sametime Instant Message (IM).
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21633618; https://exchange.xforce.ibmcloud.com/vulnerabilities/82915; http://www-01.ibm.com/support/docview.wss?uid=swg21633618
CVE: CVE-2013-1198
Published: 2013-04-29
Description: Cross-site scripting (XSS) vulnerability in a Flash component in Cisco Unified Computing System (UCS) Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1198; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1198
CVE: CVE-2013-1216
Published: 2013-04-29
Description: Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory consumption and process restart) via crafted SNMP packets, aka Bug ID CSCue31546.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1216; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1216
CVE: CVE-2013-1219
Published: 2013-04-29
Description: SensorApp in Cisco Intrusion Prevention System (IPS) allows local users to cause a denial of service (Regex hardware job failure and application hang) via a (1) initiate signature upgrade, (2) initiate global correlation, (3) show statistics anomaly-detection, or (4) clear database action, aka Bug ID CSCuc74630.
CVSS Score: 4.4 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1219; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1219
CVE: CVE-2013-1226
Published: 2013-04-29
Description: The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service (forwarding loop and service outage) via a crafted frame, aka Bug ID CSCug47098.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1226; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1226
CVE: CVE-2013-1227
Published: 2013-04-29
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCug37902.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1227; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1227
CVE: CVE-2013-1928
Published: 2013-04-29
Description: The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=[PII_REDACTED]885edd542389eed3aaf94be163fdb; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html
CVE: CVE-2013-2015
Published: 2013-04-29
Description: The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e9a9a1ad619e7e987815d20262d36a2f95717ca; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.3
CVE: CVE-2013-3301
Published: 2013-04-29
Description: The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.
CVSS Score: 7.2 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6a76f8c0ab19f215af2a3442870eeb5f0e81998d; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
CVE: CVE-2013-3302
Published: 2013-04-29
Description: Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ea702b80e0bbb2448e[PII_REDACTED]88beb82ca2fe; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.2; http://www.openwall.com/lists/oss-security/2013/04/15/2
CVE: CVE-2012-5221
Published: 2013-04-29
Description: Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4345, M50xx, M90xx, P3005, and P4xxx; LaserJet Enterprise P3015; Color LaserJet 3xxx, 47xx, 5550, 9500, CM60xx, CP35xx, CP4005, and CP6015; Color LaserJet Enterprise CP4xxx; and 9250c Digital Sender with model-dependent firmware through 52.x allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1023; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03744742; http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1023
CVE: CVE-2013-1196
Published: 2013-04-29
Description: The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning Manager, Network Services Manager, Prime Data Center Network Manager (DCNM), and Quad does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416, CSCug29418, CSCug29422, CSCug29425, and CSCug29426, a different issue than CVE-2013-1125.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1196; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1196
CVE: CVE-2013-1914
Published: 2013-04-29
Description: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html; http://rhn.redhat.com/errata/RHSA-2013-0769.html; http://rhn.redhat.com/errata/RHSA-2013-1605.html
CVE: CVE-2013-1926
Published: 2013-04-29
Description: The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
CVSS Score: 5.8 (MEDIUM)
References: http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS; http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586; http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c
CVE: CVE-2013-1927
Published: 2013-04-29
Description: The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."
CVSS Score: 6.8 (MEDIUM)
References: http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS; http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/cb58b31c450e; http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/19f5282f53e8
CVE: CVE-2013-1944
Published: 2013-04-29
Description: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://curl.haxx.se/docs/adv_20130412.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html
CVE: CVE-2012-5945
Published: 2013-04-30
Description: Multiple buffer overflows in the Vsflex8l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allow remote attackers to execute arbitrary code via a long (1) ComboList or (2) ColComboList property value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635515; https://exchange.xforce.ibmcloud.com/vulnerabilities/80561; http://www-01.ibm.com/support/docview.wss?uid=swg21635515
CVE: CVE-2012-5946
Published: 2013-04-30
Description: Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635476; https://exchange.xforce.ibmcloud.com/vulnerabilities/80562; http://www-01.ibm.com/support/docview.wss?uid=swg21635476
CVE: CVE-2012-5947
Published: 2013-04-30
Description: Buffer overflow in the vsflex7l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635511; https://exchange.xforce.ibmcloud.com/vulnerabilities/80563; http://www-01.ibm.com/support/docview.wss?uid=swg21635511