deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3033
Published: 2013-07-29
Description: SQL injection vulnerability in the server component in IBM Tivoli Remote Control 5.1.2 before 5.1.2-TIV-TRC512-IF0015 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21643363; https://exchange.xforce.ibmcloud.com/vulnerabilities/84645; http://www-01.ibm.com/support/docview.wss?uid=swg21643363
CVE: CVE-2013-3580
Published: 2013-07-29
Description: The TrustGo Antivirus & Mobile Security application before 1.3.6 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.trustgo.mobile.security.USSDScannerActivity with zero arguments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/709806; https://play.google.com/store/apps/details?id=com.trustgo.mobile.security; http://www.kb.cert.org/vuls/id/709806
CVE: CVE-2011-1483
Published: 2013-07-29
Description: wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
References: http://source.jboss.org/changelog/JBossWS/?cs=13996; https://bugzilla.redhat.com/show_bug.cgi?id=692584; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583
CVE: CVE-2013-4127
Published: 2013-07-29
Description: Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local users to cause a denial of service (OOPS and system crash) via vectors involving powering on a virtual machine.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=dd7633ecd553a5e304d349aa6f8eb8a0417098c5; http://www.openwall.com/lists/oss-security/2013/07/15/7; https://bugzilla.redhat.com/show_bug.cgi?id=980643
CVE: CVE-2013-4129
Published: 2013-07-29
Description: The bridge multicast implementation in the Linux kernel through 3.10.3 does not check whether a certain timer is armed before modifying the timeout value of that timer, which allows local users to cause a denial of service (BUG and system crash) via vectors involving the shutdown of a KVM virtual machine, related to net/bridge/br_mdb.c and net/bridge/br_multicast.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c7e8e8a8f7a70b343ca1e0f90a31e35ab2d16de1; http://www.openwall.com/lists/oss-security/2013/07/16/1; http://www.securityfocus.com/bid/61193
CVE: CVE-2013-4162
Published: 2013-07-29
Description: The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-4163
Published: 2013-07-29
Description: The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=75a493e60ac4bbe2e977e7129d6d8cbb0dd236be; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-4851
Published: 2013-07-29
Description: The vfs_hang_addrlist function in sys/kern/vfs_export.c in the NFS server implementation in the kernel in FreeBSD 8.3 and 9.x through 9.1-RELEASE-p5 controls authorization for host/subnet export entries on the basis of group information sent by the client, which allows remote attackers to bypass file permissions on NFS filesystems via crafted requests.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://svnweb.freebsd.org/base?view=revision&revision=244226; http://www.freebsd.org/security/advisories/FreeBSD-SA-13:08.nfsserver.asc; http://www.securityfocus.com/bid/61484
CVE: CVE-2013-0723
Published: 2013-07-29
Description: Multiple heap-based buffer overflows in etxrw.dll in Kingsoft Spreadsheets 2012 8.1.0.3030 allow remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a crafted spreadsheet file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/51418/; http://www.securitytracker.com/id/1028713; http://secunia.com/advisories/51418/
CVE: CVE-2013-2181
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in the Directory Listing plugin in Monkey HTTP Daemon (monkeyd) 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.monkey-project.com/ticket/185; http://www.securitytracker.com/id/1028670; http://bugs.monkey-project.com/ticket/185
CVE: CVE-2013-3515
Published: 2013-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/94774; http://osvdb.org/94775; http://seclists.org/bugtraq/2013/Jul/27
CVE: CVE-2013-4944
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message parameter to wp-admin/admin-ajax.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/94807; http://secunia.com/advisories/54048; http://wordpress.org/plugins/buddypress-extended-friendship-request/changelog/
CVE: CVE-2013-4140
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in the TinyBox (Simple Splash) module before 7.x-2.2 for Drupal allows remote authenticated users with the "administer tinybox" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/95153; http://seclists.org/fulldisclosure/2013/Jul/86; http://secunia.com/advisories/54091
CVE: CVE-2013-4945
Published: 2013-07-29
Description: Multiple SQL injection vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to execute arbitrary SQL commands via the (1) ASPSESSIONIDASSRATTQ, (2) TABLE_WIDGET_1, (3) TABLE_WIDGET_2, (4) browserDateTimeInfo, or (5) browserNumberInfo cookie parameter to DashBoardGUI.aspx; or the (6) UID parameter to login.aspx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0082.html; http://www.exploit-db.com/exploits/26806; http://www.securityfocus.com/bid/61147
CVE: CVE-2013-4946
Published: 2013-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML via the (1) SelTab parameter to QV_admin.aspx, the (2) CallBack parameter to QV_grid.aspx, or the (3) HelpPage parameter to commonhelp.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0082.html; http://www.exploit-db.com/exploits/26806; http://www.securityfocus.com/bid/61147
CVE: CVE-2013-4947
Published: 2013-07-29
Description: Unspecified vulnerability in the update and build database page in Sawmill before 8.6.3 allows remote attackers to have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/95059; http://secunia.com/advisories/54090; http://www.sawmill.net/version_history8.html
CVE: CVE-2013-4948
Published: 2013-07-29
Description: SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/94801; http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html; http://www.exploit-db.com/exploits/26553
CVE: CVE-2013-4949
Published: 2013-07-29
Description: Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/94802; http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html; http://www.exploit-db.com/exploits/26553
CVE: CVE-2013-4950
Published: 2013-07-29
Description: Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element_2 parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/94803; http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html; http://www.exploit-db.com/exploits/26553
CVE: CVE-2013-4951
Published: 2013-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mintboard 0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) pass parameter in views/login.php or (3) name or (4) pass parameter in views/signup.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95120; http://seclists.org/fulldisclosure/2013/Jul/101; http://www.securityfocus.com/bid/61114
CVE: CVE-2013-4952
Published: 2013-07-29
Description: SQL injection vulnerability in functions/global.php in Elemata CMS RC 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/26416; http://www.exploit-db.com/exploits/26416
CVE: CVE-2013-4953
Published: 2013-07-29
Description: SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/53977; http://www.exploit-db.com/exploits/26405; http://secunia.com/advisories/53977
CVE: CVE-2013-4954
Published: 2013-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/95160; http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-register; http://secunia.com/advisories/54123
CVE: CVE-2013-4920
Published: 2013-07-30
Description: The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=50083; http://secunia.com/advisories/54296; http://secunia.com/advisories/54425
CVE: CVE-2013-4921
Published: 2013-07-30
Description: Off-by-one error in the dissect_radiotap function in epan/dissectors/packet-ieee80211-radiotap.c in the Radiotap dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ieee80211-radiotap.c?r1=50090&r2=50089&pathrev=50090; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50090; http://secunia.com/advisories/54296
CVE: CVE-2013-4922
Published: 2013-07-30
Description: Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50094&r2=50093&pathrev=50094; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50094; http://secunia.com/advisories/54296
CVE: CVE-2013-4923
Published: 2013-07-30
Description: Memory leak in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (memory consumption) via crafted packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50094&r2=50093&pathrev=50094; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50094; http://secunia.com/advisories/54296
CVE: CVE-2013-4924
Published: 2013-07-30
Description: epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50432&r2=50431&pathrev=50432; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50432; http://secunia.com/advisories/54296
CVE: CVE-2013-4925
Published: 2013-07-30
Description: Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50478&r2=50477&pathrev=50478; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50478; http://secunia.com/advisories/54296
CVE: CVE-2013-4926
Published: 2013-07-30
Description: epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcom-sysact.c?r1=50478&r2=50477&pathrev=50478; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50478; http://secunia.com/advisories/54296
CVE: CVE-2013-4927
Published: 2013-07-30
Description: Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-btsdp.c?r1=50134&r2=50133&pathrev=50134; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50134; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4928
Published: 2013-07-30
Description: Integer signedness error in the dissect_headers function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-btobex.c?r1=50258&r2=50257&pathrev=50258; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50258; http://secunia.com/advisories/54296
CVE: CVE-2013-4929
Published: 2013-07-30
Description: The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes, which allows remote attackers to cause a denial of service (loop) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dis-pdus.c?r1=50450&r2=50449&pathrev=50450; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50450; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4930
Published: 2013-07-30
Description: The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dvbci.c?r1=50474&r2=50473&pathrev=50474; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50474; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4931
Published: 2013-07-30
Description: epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/proto.c?r1=50504&r2=50503&pathrev=50504; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50504; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4932
Published: 2013-07-30
Description: Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-gsm_a_common.c?r1=50672&r2=50671&pathrev=50672; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50672; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4933
Published: 2013-07-30
Description: The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/wiretap/netmon.c?r1=49673&r2=49672&pathrev=49673; http://anonsvn.wireshark.org/viewvc?view=revision&revision=49673; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4934
Published: 2013-07-30
Description: The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/wiretap/netmon.c?r1=49697&r2=49696&pathrev=49697; http://anonsvn.wireshark.org/viewvc?view=revision&revision=49697; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4935
Published: 2013-07-30
Description: The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-per.c?r1=49985&r2=49984&pathrev=49985; http://anonsvn.wireshark.org/viewvc?view=revision&revision=49985; http://lists.opensuse.org/opensuse-updates/2013-08/msg00004.html
CVE: CVE-2013-4936
Published: 2013-07-30
Description: The IsDFP_Frame function in plugins/profinet/packet-pn-rt.c in the PROFINET Real-Time dissector in Wireshark 1.10.x before 1.10.1 does not validate MAC addresses, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
References: http://anonsvn.wireshark.org/viewvc/trunk/plugins/profinet/packet-pn-rt.c?r1=50651&r2=50650&pathrev=50651; http://anonsvn.wireshark.org/viewvc?view=revision&revision=50651; http://secunia.com/advisories/54296
CVE: CVE-2013-4995
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/59832; http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php; http://www.securityfocus.com/bid/61510
CVE: CVE-2013-4996
Published: 2013-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59832; http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php
CVE: CVE-2013-4997
Published: 2013-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php