deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6598
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6598; https://security.paloaltonetworks.com/CVE-2012-6598
CVE: CVE-2012-6599
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33476.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6599; https://security.paloaltonetworks.com/CVE-2012-6599
CVE: CVE-2012-6600
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6600; https://security.paloaltonetworks.com/CVE-2012-6600
CVE: CVE-2012-6601
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6601; https://security.paloaltonetworks.com/CVE-2012-6601
CVE: CVE-2012-6602
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6602; https://security.paloaltonetworks.com/CVE-2012-6602
CVE: CVE-2012-6603
Published: 2013-08-31
Description: The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to bypass authentication and obtain administrator privileges via unspecified vectors, aka Ref ID 37034.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: https://security.paloaltonetworks.com/CVE-2012-6603; https://security.paloaltonetworks.com/CVE-2012-6603
CVE: CVE-2012-6604
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6604; https://security.paloaltonetworks.com/CVE-2012-6604
CVE: CVE-2012-6605
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6605; https://security.paloaltonetworks.com/CVE-2012-6605
CVE: CVE-2012-6606
Published: 2013-08-31
Description: Palo Alto Networks GlobalProtect before 1.1.7, and NetConnect, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof portal servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0100.html; https://security.paloaltonetworks.com/CVE-2012-6606; http://archives.neohapsis.com/archives/bugtraq/2012-10/0100.html
CVE: CVE-2013-5663
Published: 2013-08-31
Description: The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx; http://pastie.org/pastes/5568186/text; http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/
CVE: CVE-2013-5664
Published: 2013-08-31
Description: Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://security.paloaltonetworks.com/CVE-2013-5664; https://security.paloaltonetworks.com/CVE-2013-5664
CVE: CVE-2013-1661
Published: 2013-09-04
Description: VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.vmware.com/security/advisories/VMSA-2013-0011.html; http://www.vmware.com/security/advisories/VMSA-2013-0011.html
CVE: CVE-2013-3469
Published: 2013-09-04
Description: Cisco Mobility Services Engine does not properly set up the Oracle SSL service, which allows remote attackers to obtain an unauthenticated session to the database-replication port, and consequently obtain sensitive information, via an SSL connection, aka Bug ID CSCue50794.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3469; http://tools.cisco.com/security/center/viewAlert.x?alertId=30617; http://www.securityfocus.com/bid/62091
CVE: CVE-2013-5470
Published: 2013-09-04
Description: Cisco Secure Access Control System (ACS) does not properly handle requests to read from the TACACS+ socket, which allows remote attackers to cause a denial of service (process crash) via malformed TCP packets, aka Bug ID CSCuh12488.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/96822; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5470; http://www.securityfocus.com/bid/62145
CVE: CVE-2013-3479
Published: 2013-09-05
Description: Cross-site request forgery (CSRF) vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53135; http://wordpress.org/plugins/share-this/changelog/; http://secunia.com/advisories/53135
CVE: CVE-2013-5471
Published: 2013-09-05
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Global Site Selector (GSS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuh42164.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/96823; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5471; http://www.securityfocus.com/bid/62166
CVE: CVE-2013-1645
Published: 2013-09-05
Description: Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the publication template path.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1646
Published: 2013-09-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via (1) invalid JSON data in a mail-sending POST request, (2) an arbitrary parameter to servlet/TestServlet, (3) a javascript: URL in a standalone-mode action to a UWA module, (4) an infostore attachment, (5) JavaScript code in a contact image, (6) an RSS feed, or (7) a signature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1647
Published: 2013-09-05
Description: Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter, as demonstrated by (1) the location parameter to ajax/redirect or (2) multiple infostore URIs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1648
Published: 2013-09-05
Description: The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1649
Published: 2013-09-05
Description: Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1650
Published: 2013-09-05
Description: Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak permissions (group "other" readable) under opt/open-xchange/etc/, which allows local users to obtain sensitive information via standard filesystem operations.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-1651
Published: 2013-09-05
Description: OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html
CVE: CVE-2013-2582
Published: 2013-09-05
Description: CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html; http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html
CVE: CVE-2013-2583
Published: 2013-09-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL, (2) malformed nested SCRIPT elements, (3) a mail signature, or (4) JavaScript code within an image file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html; http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html
CVE: CVE-2013-3106
Published: 2013-09-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via (1) embedded VBScript, (2) object/data Base64 content, (3) a Content-Type header, or (4) UTF-16 encoding, aka Bug IDs 25957, 26237, 26243, and 26244.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html; http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html
CVE: CVE-2013-3276
Published: 2013-09-05
Description: EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0013.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0013.html
CVE: CVE-2013-3277
Published: 2013-09-05
Description: Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0013.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0013.html
CVE: CVE-2013-4790
Published: 2013-09-05
Description: Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in opportunistic circumstances via a manual-mode association of a personal e-mail address with the hostname of a crafted IMAP server.
CVSS Score: 3.5 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0204.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0204.html
CVE: CVE-2013-5035
Published: 2013-09-05
Description: Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0115.html; http://sourceforge.net/p/htmlcleaner/bugs/86/; http://archives.neohapsis.com/archives/bugtraq/2013-08/0115.html
CVE: CVE-2013-5698
Published: 2013-09-05
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, a different vulnerability than CVE-2013-3106.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html; http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html
CVE: CVE-2012-5990
Published: 2013-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Health Monitor Login pages in Cisco Prime Network Control System (NCS) and Wireless Control System (WCS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud18375.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/830316; http://www.kb.cert.org/vuls/id/830316
CVE: CVE-2013-1115
Published: 2013-09-06
Description: Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ARF file, aka Bug IDs CSCue74118, CSCub28371, CSCud23401, and CSCud31109.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex
CVE: CVE-2013-1116
Published: 2013-09-06
Description: Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted ARF file, aka Bug IDs CSCue74147 and CSCub28383.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex
CVE: CVE-2013-1117
Published: 2013-09-06
Description: Buffer overflow in the exception handler in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCuc27639.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex
CVE: CVE-2013-1118
Published: 2013-09-06
Description: Stack-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCuc27645.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex
CVE: CVE-2013-1119
Published: 2013-09-06
Description: Buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DHT index value in JPEG data within a WRF file, aka Bug ID CSCuc24503.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130904-webex
CVE: CVE-2013-1228
Published: 2013-09-06
Description: Cisco Jabber on Windows does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify the client-server data stream via a crafted certificate, aka Bug ID CSCug30280.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1228; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1228
CVE: CVE-2013-3599
Published: 2013-09-06
Description: userlogin.jsp in Coursemill Learning Management System (LMS) 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3600
Published: 2013-09-06
Description: Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3601
Published: 2013-09-06
Description: Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3602
Published: 2013-09-06
Description: SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3603
Published: 2013-09-06
Description: Cross-site scripting (XSS) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3604
Published: 2013-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3605
Published: 2013-09-06
Description: Cross-site request forgery (CSRF) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-5706
Published: 2013-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and (1) crafted event attributes or (2) > (greater than) characters that are optional within a browser's HTML implementation, a different issue than CVE-2013-3603.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-5707
Published: 2013-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence, a different issue than CVE-2013-3604.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-5708
Published: 2013-09-06
Description: Coursemill Learning Management System (LMS) 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via vectors related to cookies, a different vulnerability than CVE-2013-3605.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/960908; http://www.kb.cert.org/vuls/id/960908
CVE: CVE-2013-3458
Published: 2013-09-08
Description: Cisco Adaptive Security Appliances (ASA) devices, when SMP is used, do not properly process X.509 certificates, which allows remote attackers to cause a denial of service (device crash) via a large volume of (1) SSL or (2) TLS traffic, aka Bug ID CSCuh19462.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3458; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3458