deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2076
Published: 2013-08-28
Description: Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056.  NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2013-2077
Published: 2013-08-28
Description: Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2013-2176
Published: 2013-08-28
Description: Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2013-1122.html; http://rhn.redhat.com/errata/RHSA-2013-1122.html
CVE: CVE-2013-2211
Published: 2013-08-28
Description: The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2013-2212
Published: 2013-08-28
Description: The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2013-3495
Published: 2013-08-28
Description: The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://osvdb.org/96438
CVE: CVE-2013-4111
Published: 2013-08-28
Description: The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html; http://rhn.redhat.com/errata/RHSA-2013-1200.html; http://secunia.com/advisories/54313
CVE: CVE-2013-2123
Published: 2013-08-28
Description: The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attackers to modify the content via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/05/29/9; https://drupal.org/node/2007072; https://drupal.org/node/2007078
CVE: CVE-2013-2197
Published: 2013-08-28
Description: The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal, when using the login delay option, allows remote attackers to cause a denial of service (CPU consumption) via a large number of failed login attempts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2013/06/20/3; https://drupal.org/node/2023503; https://drupal.org/node/2023507
CVE: CVE-2013-2247
Published: 2013-08-28
Description: The Fast Permissions Administration module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to the modal content callback, which allows remote attackers to obtain unspecified access to the permissions edit form.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/07/06/3; https://drupal.org/node/2028417; https://drupal.org/node/2028421
CVE: CVE-2013-4138
Published: 2013-08-28
Description: Cross-site scripting (XSS) vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the "Administer content," "Create new article," or "Edit any article type content" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/07/17/1; https://drupal.org/node/2038189; https://drupal.org/node/2038363
CVE: CVE-2013-4139
Published: 2013-08-28
Description: The Stage File Proxy module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to cause a denial of service (file operations performance degradation and failure) via a large number of requests.
CVSS Score: 5.0 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2013/07/17/1; https://drupal.org/node/2038799; https://drupal.org/node/2038801
CVE: CVE-2013-4272
Published: 2013-08-28
Description: The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging level is set to 5 or 6, logs the content of submitted forms, which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/08/22/2; https://drupal.org/node/2064781; https://drupal.org/node/2064783
CVE: CVE-2013-4274
Published: 2013-08-28
Description: Cross-site scripting (XSS) vulnerability in the password_policy_admin_view function in password_policy.admin.inc in the Password Policy module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the admin/config/people/password_policy/add page.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.madirish.net/557; http://www.openwall.com/lists/oss-security/2013/08/22/2; http://www.securityfocus.com/bid/61780
CVE: CVE-2013-2035
Published: 2013-08-28
Description: Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2013-1029.html; http://rhn.redhat.com/errata/RHSA-2013-1784.html; http://rhn.redhat.com/errata/RHSA-2013-1785.html
CVE: CVE-2013-2178
Published: 2013-08-28
Description: The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block arbitrary IP addresses via certain messages in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00021.html; http://www.debian.org/security/2013/dsa-2708; http://www.openwall.com/lists/oss-security/2013/06/13/7
CVE: CVE-2013-5018
Published: 2013-08-28
Description: The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00021.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00022.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00050.html
CVE: CVE-2013-3466
Published: 2013-08-29
Description: The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID CSCui57636.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://osvdb.org/96668; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130828-acs; http://www.securitytracker.com/id/1028958
CVE: CVE-2013-3468
Published: 2013-08-29
Description: The Cisco Unified IP Phone 8945 with software 9.3(2) allows remote attackers to cause a denial of service (device hang) via a malformed PNG file, aka Bug ID CSCud04270.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/96669; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3468; http://www.securitytracker.com/id/1028964
CVE: CVE-2013-3471
Published: 2013-08-29
Description: The captive portal application in Cisco Identity Services Engine (ISE) allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3471; http://tools.cisco.com/security/center/viewAlert.x?alertId=30524; http://www.securitytracker.com/id/1028965
CVE: CVE-2013-3472
Published: 2013-08-29
Description: Cross-site request forgery (CSRF) vulnerability in the Enterprise License Manager (ELM) in Cisco Unified Communications Manager (CM) allows remote attackers to hijack the authentication of arbitrary users for requests that make ELM modifications, aka Bug ID CSCui58210.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3472; http://www.securitytracker.com/id/1028963; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3472
CVE: CVE-2013-4003
Published: 2013-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3.1.1, and 8, allow remote authenticated users to inject arbitrary web script or HTML via (1) unspecified input to WebProcess.srv, (2) unspecified input to html/en/default/actionHandler/queryHandler.jsp, or (3) unspecified input in a portalSectionId action to html/en/default/reportTemplate/hGridTopQuery.jsp.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21646694; https://exchange.xforce.ibmcloud.com/vulnerabilities/85266; https://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_tririga_application_platform_has_potential_cross_site_scripting_vulnerabilities_in_various_url_s
CVE: CVE-2013-5209
Published: 2013-08-29
Description: The sctp_send_initiate_ack function in sys/netinet/sctp_output.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure, which allows remote attackers to obtain sensitive information from kernel stack memory by reading packet data in INIT-ACK chunks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://svnweb.freebsd.org/base?view=revision&revision=254338; http://www.freebsd.org/security/advisories/FreeBSD-SA-13:10.sctp.asc; http://www.securityfocus.com/bid/61939
CVE: CVE-2013-5588
Published: 2013-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2) the id parameter to cacti/host.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.cacti.net/view.php?id=2383; http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html; http://secunia.com/advisories/54652
CVE: CVE-2013-5589
Published: 2013-08-29
Description: SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2383; http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html; http://secunia.com/advisories/54652
CVE: CVE-2013-5645
Published: 2013-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html; http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github; http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github
CVE: CVE-2013-5646
Published: 2013-08-29
Description: Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://trac.roundcube.net/ticket/1489251; http://trac.roundcube.net/ticket/1489251
CVE: CVE-2013-5647
Published: 2013-08-29
Description: lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html; http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html
CVE: CVE-2013-5648
Published: 2013-08-29
Description: Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / (slash) or \ (backslash) in a DDOC file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://svnweb.mageia.org/packages/updates/3/libdigidoc/current/SOURCES/libdigidoc-3.6.0.0-security-fix-DataFile-name-tag.patch?revision=472660&view=markup; http://www.id.ee/?lang=en&id=34283#3_7_2; https://bugs.mageia.org/show_bug.cgi?id=11100
CVE: CVE-2012-5744
Published: 2013-08-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the guest portal in Cisco Identity Services Engine (ISE) Software allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCud11139 and CSCug02904.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5744; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5744
CVE: CVE-2013-3463
Published: 2013-08-30
Description: The protocol-inspection feature on Cisco Adaptive Security Appliances (ASA) devices does not properly implement the idle timeout, which allows remote attackers to cause a denial of service (connection-table exhaustion) via crafted requests that use an inspected protocol, aka Bug ID CSCuh13899.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3463; http://tools.cisco.com/security/center/viewAlert.x?alertId=30607; http://www.securityfocus.com/bid/62068
CVE: CVE-2013-3467
Published: 2013-08-30
Description: Memory leak in the CLI component on Cisco Unified Computing System (UCS) 6100 Fabric Interconnect devices, in certain situations that lack a SPAN session, allows local users to cause a denial of service (memory consumption and device reset) via a (1) "show monitor session all" or (2) "show monitor session" command, aka Bug ID CSCug20103.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/96731; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3467; http://www.securityfocus.com/bid/62065
CVE: CVE-2013-3470
Published: 2013-08-30
Description: The RIP process in Cisco IOS XR allows remote attackers to cause a denial of service (process crash) via a crafted version-2 RIP packet, aka Bug ID CSCue46731.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/96732; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3470; http://www.securityfocus.com/bid/62066
CVE: CVE-2013-3346
Published: 2013-08-30
Description: Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://www.adobe.com/support/security/bulletins/apsb13-15.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19054; http://www.adobe.com/support/security/bulletins/apsb13-15.html
CVE: CVE-2013-3474
Published: 2013-08-30
Description: The Web Administrator Interface on Cisco Wireless LAN Controller (WLC) devices allows remote authenticated users to cause a denial of service (device crash) by leveraging membership in the Full Manager managers group, Read Only managers group, or Lobby Ambassador managers group, and sending a request that (1) lacks a parameter value or (2) contains a malformed parameter value, aka Bug IDs CSCuh14313, CSCuh14159, CSCuh14368, and CSCuh14436.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/96763; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3474; http://www.securityfocus.com/bid/62084
CVE: CVE-2013-5469
Published: 2013-08-30
Description: The TCP implementation in Cisco IOS does not properly implement the transitions from the ESTABLISHED state to the CLOSED state, which allows remote attackers to cause a denial of service (flood of ACK packets) via a crafted series of ACK and FIN packets, aka Bug ID CSCtz14399.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://osvdb.org/96764; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5469; http://www.securityfocus.com/bid/62083
CVE: CVE-2013-3485
Published: 2013-08-30
Description: Multiple untrusted search path vulnerabilities in Soda PDF 5.1.183.10520 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) api-ms-win-core-localregistry-l1-1-0.dll file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/53207; http://secunia.com/advisories/53207
CVE: CVE-2013-4702
Published: 2013-08-30
Description: Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN15973066/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000081; http://osvdb.org/96756
CVE: CVE-2012-6590
Published: 2013-08-31
Description: The web-based management UI in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote attackers to obtain verbose error information via crafted input, aka Ref ID 33139.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://security.paloaltonetworks.com/CVE-2012-6590; https://security.paloaltonetworks.com/CVE-2012-6590
CVE: CVE-2012-6591
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6591; https://security.paloaltonetworks.com/CVE-2012-6591
CVE: CVE-2012-6592
Published: 2013-08-31
Description: Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 31091.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6592; https://security.paloaltonetworks.com/CVE-2012-6592
CVE: CVE-2012-6593
Published: 2013-08-31
Description: Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 30088.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6593; https://security.paloaltonetworks.com/CVE-2012-6593
CVE: CVE-2012-6594
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34299.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6594; https://security.paloaltonetworks.com/CVE-2012-6594
CVE: CVE-2012-6595
Published: 2013-08-31
Description: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2012-6595; https://security.paloaltonetworks.com/CVE-2012-6595
CVE: CVE-2012-6596
Published: 2013-08-31
Description: Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passwords in authd.log, which allows context-dependent attackers to obtain sensitive information by reading this file, aka Ref ID 35493.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://security.paloaltonetworks.com/CVE-2012-6596; https://security.paloaltonetworks.com/CVE-2012-6596
CVE: CVE-2012-6597
Published: 2013-08-31
Description: Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command, aka Ref ID 35254.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://security.paloaltonetworks.com/CVE-2012-6597; https://security.paloaltonetworks.com/CVE-2012-6597