deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2984
Published: 2013-07-03
Description: Directory traversal vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to read or modify files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC91046; http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/84006
CVE: CVE-2013-2985
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/84008; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-2987
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-3020, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/84009; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-3020
Published: 2013-07-03
Description: IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640830; https://exchange.xforce.ibmcloud.com/vulnerabilities/84359; http://www-01.ibm.com/support/docview.wss?uid=swg21640830
CVE: CVE-2013-1960
Published: 2013-07-03
Description: Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104916.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105253.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105828.html
CVE: CVE-2013-1961
Published: 2013-07-03
Description: Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104916.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105253.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105828.html
CVE: CVE-2013-2116
Published: 2013-07-03
Description: The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length.  NOTE: this might be due to an incorrect fix for CVE-2013-0169.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html
CVE: CVE-2013-2144
Published: 2013-07-03
Description: Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0888.html; http://rhn.redhat.com/errata/RHSA-2013-0888.html
CVE: CVE-2013-2168
Published: 2013-07-03
Description: The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://cgit.freedesktop.org/dbus/dbus/commit/?id=954d75b2b64e4799f360d2a6bf9cff6d9fee37e7; http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109896.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-June/110114.html
CVE: CVE-2011-3116
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-3117
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-3118
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-3119
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-3120
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2011-4072
Published: 2013-07-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2013-3413
Published: 2013-07-04
Description: Cross-site scripting (XSS) vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh87036.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3413; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3413
CVE: CVE-2013-3563
Published: 2013-07-04
Description: Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/25851/; http://www.exploit-db.com/exploits/25851/
CVE: CVE-2013-3742
Published: 2013-07-04
Description: Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php; https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf; http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php
CVE: CVE-2013-4650
Published: 2013-07-04
Description: MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.mongodb.org/about/alerts/; https://jira.mongodb.org/browse/SERVER-9983; http://www.mongodb.org/about/alerts/
CVE: CVE-2013-4729
Published: 2013-07-04
Description: import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php; https://github.com/phpmyadmin/phpmyadmin/commit/[PII_REDACTED]20e53a9cd81cbb4a43988d70393c36; http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php
CVE: CVE-2013-2164
Published: 2013-07-04
Description: The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/drivers/cdrom/cdrom.c?id=050e4b8fb7cdd7096c987a9cd556029c622c7fe2; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-2206
Published: 2013-07-04
Description: The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.
CVSS Score: 5.4 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f[PII_REDACTED]b442ca0b0605c16bf3d88a3a0fcea; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00021.html
CVE: CVE-2013-2224
Published: 2013-07-04
Description: A certain Red Hat patch for the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows local users to cause a denial of service (invalid free operation and system crash) or possibly gain privileges via a sendmsg system call with the IP_RETOPTS option, as demonstrated by hemlock.c.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-3552.
CVSS Score: 6.9 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1166.html; http://rhn.redhat.com/errata/RHSA-2013-1173.html; http://rhn.redhat.com/errata/RHSA-2013-1450.html
CVE: CVE-2013-2232
Published: 2013-07-04
Description: The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a963a37d384d71ad43b3e9e79d68d42fbe0901f3; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-2234
Published: 2013-07-04
Description: The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-2237
Published: 2013-07-04
Description: The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=85dfb745ee[PII_REDACTED]3ae206cba35f24ab2a40; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
CVE: CVE-2013-0581
Published: 2013-07-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socialPortal/dashboard.jsp, (2) teamworks/executeServiceByName, (3) portal/jsp/viewAdHocReportWizard.do, or (4) rest/bpm/wle/v1/process.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR45799; http://www-01.ibm.com/support/docview.wss?uid=swg21633593; https://exchange.xforce.ibmcloud.com/vulnerabilities/83333
CVE: CVE-2013-2340
Published: 2013-07-06
Description: Unspecified vulnerability on the HP ProCurve JC###A, JC###B, JD###A, JD###B, JE###A, JF###A, JF###B, JF###C, JG###A, 658250-B21, and 658247-B21; HP 3COM routers and switches; and HP H3C routers and switches allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03808969; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03808969
CVE: CVE-2013-2341
Published: 2013-07-06
Description: Unspecified vulnerability on the HP ProCurve JC###A, JC###B, JD###A, JD###B, JE###A, JF###A, JF###B, JF###C, JG###A, 658250-B21, and 658247-B21; HP 3COM routers and switches; and HP H3C routers and switches allows remote authenticated users to execute arbitrary code or obtain sensitive information via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03808969; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03808969
CVE: CVE-2013-3005
Published: 2013-07-06
Description: The TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled, allows remote authenticated users to bypass intended file-ownership restrictions, and read or overwrite arbitrary files, via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/tftp_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IV40221; http://www.ibm.com/support/docview.wss?uid=isg1IV42700
CVE: CVE-2013-3299
Published: 2013-07-06
Description: RealNetworks RealPlayer 16.0.2.32 and earlier allows remote attackers to cause a denial of service (resource consumption or application crash) via an HTML document containing JavaScript code that constructs a long string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2013/Jul/18; http://seclists.org/bugtraq/2013/Jul/18
CVE: CVE-2013-1059
Published: 2013-07-08
Description: net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://hkpco.kr/advisory/CVE-2013-1059.txt; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
CVE: CVE-2013-1414
Published: 2013-07-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/26528/; http://www.exploit-db.com/exploits/26528/
CVE: CVE-2013-1613
Published: 2013-07-08
Description: SQL injection vulnerability in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/60796; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00; http://www.securityfocus.com/bid/60796
CVE: CVE-2013-1614
Published: 2013-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/60797; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00; http://www.securityfocus.com/bid/60797
CVE: CVE-2013-1615
Published: 2013-07-08
Description: The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote attackers to obtain sensitive information via unspecified web-GUI API calls.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/60798; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00; http://www.securityfocus.com/bid/60798
CVE: CVE-2013-0235
Published: 2013-07-08
Description: The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
CVSS Score: 6.4 (MEDIUM)
References: http://codex.wordpress.org/Version_3.5.1; http://core.trac.wordpress.org/changeset/23330; http://wordpress.org/news/2013/01/wordpress-3-5-1/
CVE: CVE-2013-0236
Published: 2013-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.5.1; http://core.trac.wordpress.org/changeset/23317; http://core.trac.wordpress.org/changeset/23322
CVE: CVE-2013-0237
Published: 2013-07-08
Description: Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.5.1; http://wordpress.org/news/2013/01/wordpress-3-5-1/; https://bugzilla.redhat.com/show_bug.cgi?id=904122
CVE: CVE-2013-2199
Published: 2013-07-08
Description: The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2200
Published: 2013-07-08
Description: WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2201
Published: 2013-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2202
Published: 2013-07-08
Description: WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2203
Published: 2013-07-08
Description: WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2204
Published: 2013-07-08
Description: moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://codex.wordpress.org/Version_3.5.2; http://wordpress.org/news/2013/06/wordpress-3-5-2/; http://www.debian.org/security/2013/dsa-2718
CVE: CVE-2013-2205
Published: 2013-07-08
Description: The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16, CWE-79
References: http://codex.wordpress.org/Version_3.5.2; http://make.wordpress.org/core/2013/06/21/secure-swfupload/; http://wordpress.org/news/2013/06/wordpress-3-5-2/
CVE: CVE-2013-3272
Published: 2013-07-08
Description: EMC Replication Manager (RM) before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0045.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0045.html