deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2927
Published: 2013-10-16
Description: Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2013-2928
Published: 2013-10-16
Description: Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://crbug.com/303657; http://crbug.com/303772
CVE: CVE-2013-3279
Published: 2013-10-16
Description: EMC Atmos before 2.1.4 has a blank password for the PostgreSQL account, which allows remote attackers to obtain sensitive administrative information via a database-server connection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0019.html; http://archives.neohapsis.com/archives/bugtraq/2013-10/0019.html
CVE: CVE-2013-0500
Published: 2013-10-17
Description: IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 does not properly handle device files that are created with the NFS protocol but accessed with a non-NFS protocol, which allows remote authenticated users to obtain sensitive information, modify programs or files, or cause a denial of service (device crash) via a (1) CIFS, (2) HTTPS, (3) SCP, or (4) SFTP operation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1004430; https://exchange.xforce.ibmcloud.com/vulnerabilities/84839; http://www.ibm.com/support/docview.wss?uid=ssg1S1004430
CVE: CVE-2013-3025
Published: 2013-10-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.5.x and 6.6.x before 6.6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652479; https://exchange.xforce.ibmcloud.com/vulnerabilities/84363; http://www-01.ibm.com/support/docview.wss?uid=swg21652479
CVE: CVE-2013-4389
Published: 2013-10-17
Description: Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00091.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00094.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
CVE: CVE-2013-5376
Published: 2013-10-17
Description: Cross-site scripting (XSS) vulnerability in IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" attack against an administrative user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1004452; https://exchange.xforce.ibmcloud.com/vulnerabilities/86902; http://www.ibm.com/support/docview.wss?uid=ssg1S1004452
CVE: CVE-2013-2190
Published: 2013-10-17
Description: The translate_hierarchy_event function in x11/clutter-device-manager-xi2.c in Clutter, when resuming the system, does not properly handle XIQueryDevice errors when a device has "disappeared," which causes the gnome-shell to crash and allows physically proximate attackers to access the previous gnome-shell session via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-10/msg00014.html; http://www.openwall.com/lists/oss-security/2013/06/19/1; https://bugzilla.gnome.org/show_bug.cgi?id=701974
CVE: CVE-2013-2254
Published: 2013-10-17
Description: The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4pue6PnESsP1KTdEDJm1gpkANFaK%2BvUd9mzEVT7tXL%2B3A%40mail.gmail.com%3E; http://secunia.com/advisories/55157; http://www.securityfocus.com/bid/62903
CVE: CVE-2013-4287
Published: 2013-10-17
Description: Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html; http://rhn.redhat.com/errata/RHSA-2013-1427.html; http://rhn.redhat.com/errata/RHSA-2013-1441.html
CVE: CVE-2013-4363
Published: 2013-10-17
Description: Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html; http://www.openwall.com/lists/oss-security/2013/09/14/3; http://www.openwall.com/lists/oss-security/2013/09/18/8
CVE: CVE-2013-4365
Published: 2013-10-17
Description: Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00011.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00055.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00059.html
CVE: CVE-2013-4368
Published: 2013-10-17
Description: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-4369
Published: 2013-10-17
Description: The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer dereference) by using the "@" character as the VIF rate configuration.
CVSS Score: 1.9 (LOW)
References: http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2013/10/10/11; https://exchange.xforce.ibmcloud.com/vulnerabilities/87798
CVE: CVE-2013-4370
Published: 2013-10-17
Description: The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/oss-sec/2013/q4/att-61/xsa69.patch; http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2013/10/10/13
CVE: CVE-2013-4371
Published: 2013-10-17
Description: Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-399
References: http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2013/10/10/12; http://security.gentoo.org/glsa/glsa-201407-03.xml
CVE: CVE-2013-4397
Published: 2013-10-17
Description: Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04; http://rhn.redhat.com/errata/RHSA-2013-1418.html; http://secunia.com/advisories/55188
CVE: CVE-2013-4689
Published: 2013-10-17
Description: J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators for requests that (1) create new administrator accounts or (2) have other unspecified impacts.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10597; http://osvdb.org/98325; http://secunia.com/advisories/55166
CVE: CVE-2013-6013
Published: 2013-10-17
Description: Buffer overflow in the flow daemon (flowd) in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X44 before 12.1X44-D15, 12.1X45 before 12.1X45-D10 on SRX devices, when using telnet pass-through authentication on the firewall, might allow remote attackers to execute arbitrary code via a crafted telnet message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10594; http://osvdb.org/98369; http://secunia.com/advisories/55109
CVE: CVE-2013-6015
Published: 2013-10-17
Description: Juniper Junos before 10.4S14, 11.4 before 11.4R5-S2, 12.1R before 12.1R3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D15 on SRX Series services gateways, when a plugin using TCP proxy is configured, allows remote attackers to cause a denial of service (flow daemon crash) via an unspecified sequence of TCP packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10596; http://osvdb.org/98368; http://secunia.com/advisories/55218
CVE: CVE-2013-6169
Published: 2013-10-17
Description: The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.debian.org/security/2013/dsa-2775; https://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.12/; http://www.debian.org/security/2013/dsa-2775
CVE: CVE-2013-6170
Published: 2013-10-17
Description: Juniper Junos 10.0 before 10.0S28, 10.4 before 10.4R7, 11.1 before 11.1R5, 11.2 before 11.2R2, and 11.4 before 11.4R1, when in a Next-Generation Multicast VPN (NGEN MVPN) environment, allows remote attackers to cause a denial of service (RPD routing daemon crash) via a large number of crafted PIM (S,G) join requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10548; http://secunia.com/advisories/55216; http://www.securityfocus.com/bid/62973
CVE: CVE-2012-4112
Published: 2013-10-19
Description: The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface, aka Bug ID CSCtr43330.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4112; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4112
CVE: CVE-2012-4113
Published: 2013-10-19
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and read arbitrary files via crafted command parameters within the command-line interface, aka Bug ID CSCtr43374.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4113; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4113
CVE: CVE-2012-4114
Published: 2013-10-19
Description: The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data, which allows man-in-the-middle attackers to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72949.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4114; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4114
CVE: CVE-2012-4116
Published: 2013-10-19
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM media traffic, which allows remote attackers to obtain sensitive information, and consequently complete the authentication process for a server connection, by sniffing the network, aka Bug ID CSCtr72970.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4116; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4116
CVE: CVE-2012-4117
Published: 2013-10-19
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) does not properly verify X.509 certificates, which allows man-in-the-middle attackers to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate, aka Bug ID CSCtr73033.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4117; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4117
CVE: CVE-2013-4712
Published: 2013-10-19
Description: I-O DATA DEVICE HDL-A and HDL2-A devices with firmware 1.07 and earlier do not properly manage sessions, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN52509236/225184/index.html; http://jvn.jp/en/jp/JVN52509236/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000095
CVE: CVE-2013-5372
Published: 2013-10-19
Description: The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://rhn.redhat.com/errata/RHSA-2013-1508.html
CVE: CVE-2013-5534
Published: 2013-10-19
Description: Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not a valid audio file, aka Bug ID CSCuj22948.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5534
CVE: CVE-2013-5702
Published: 2013-10-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://watchguardsecuritycenter.com/2013/10/17/watchguard-dimension-and-fireware-xtm-11-8/; http://watchguardsecuritycenter.com/2013/10/17/xtm-11-8-secfixes/; http://watchguardsecuritycenter.com/2013/10/17/watchguard-dimension-and-fireware-xtm-11-8/
CVE: CVE-2013-6021
Published: 2013-10-19
Description: Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/98752; http://watchguardsecuritycenter.com/2013/10/17/watchguard-dimension-and-fireware-xtm-11-8/; http://watchguardsecuritycenter.com/2013/10/17/xtm-11-8-secfixes/
CVE: CVE-2013-6025
Published: 2013-10-19
Description: The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to read arbitrary files via a SQL statement containing an XML document with an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/55377; http://www.kb.cert.org/vuls/id/303900; http://www.securityfocus.com/bid/63193
CVE: CVE-2013-6026
Published: 2013-10-19
Description: The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/; http://www.dlink.com/uk/en/support/security; http://www.kb.cert.org/vuls/id/248083
CVE: CVE-2013-6027
Published: 2013-10-19
Description: Stack-based buffer overflow in the RuntimeDiagnosticPing function in /bin/webs on D-Link DIR-100 routers might allow remote authenticated administrators to execute arbitrary commands via a long set/runtime/diagnostic/pingIp parameter to Tools/tools_misc.xgi.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://pastebin.com/raw.php?i=vbiG42VD; http://www.kb.cert.org/vuls/id/248083; http://pastebin.com/raw.php?i=vbiG42VD
CVE: CVE-2013-6129
Published: 2013-10-19
Description: The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.net-security.org/secworld.php?id=15743; http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5; http://www.net-security.org/secworld.php?id=15743
CVE: CVE-2012-4115
Published: 2013-10-21
Description: The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug ID CSCtr72964.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4115; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4115
CVE: CVE-2013-5542
Published: 2013-10-21
Description: Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.2), 8.7 before 8.7(1.8), 9.0 before 9.0(3.6), and 9.1 before 9.1(2.8) allows remote attackers to cause a denial of service (firewall-session disruption or device reload) via crafted ICMP packets, aka Bug ID CSCui77398.
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa
CVE: CVE-2013-5970
Published: 2013-10-21
Description: hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service outage) by modifying management traffic.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/98719; http://www.securityfocus.com/bid/63216; http://www.securitytracker.com/id/1029206
CVE: CVE-2013-5971
Published: 2013-10-21
Description: Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/98718; http://www.securityfocus.com/bid/63218; http://www.vmware.com/security/advisories/VMSA-2013-0012.html
CVE: CVE-2013-4450
Published: 2013-10-21
Description: The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/; http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/; http://lists.opensuse.org/opensuse-updates/2013-12/msg00051.html
CVE: CVE-2013-4381
Published: 2013-10-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-5938.  Reason: This candidate is a duplicate of CVE-2013-5938.  Notes: All CVE users should reference CVE-2013-5938 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4382
Published: 2013-10-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-5937.  Reason: This candidate is a duplicate of CVE-2013-5937.  Notes: All CVE users should reference CVE-2013-5937 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-5428
Published: 2013-10-22
Description: IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC93164; http://www-01.ibm.com/support/docview.wss?uid=swg1IC96617; http://www.ibm.com/support/docview.wss?uid=swg21653546
CVE: CVE-2013-5446
Published: 2013-10-22
Description: The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC93164; http://www-01.ibm.com/support/docview.wss?uid=swg1IC96617; http://www.ibm.com/support/docview.wss?uid=swg21653546