deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0259
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1897016; http://drupal.org/node/1903300; http://drupalcode.org/project/boxes.git/commitdiff/456ff8e
CVE: CVE-2013-0260
Published: 2013-03-27
Description: Unspecified vulnerability in the Drush Debian Packaging module for Drupal allows local users to obtain database credentials via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://drupal.org/node/1903324; http://www.openwall.com/lists/oss-security/2013/02/05/1; http://drupal.org/node/1903324
CVE: CVE-2013-0316
Published: 2013-03-27
Description: The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://drupal.org/SA-CORE-2013-002; http://www.openwall.com/lists/oss-security/2013/02/21/5; http://drupal.org/SA-CORE-2013-002
CVE: CVE-2013-0317
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1915408; http://drupal.org/node/1916312; http://drupalcode.org/project/og_manager_change.git/commitdiff/ab7152b
CVE: CVE-2013-0318
Published: 2013-03-27
Description: The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/1916370; http://www.openwall.com/lists/oss-security/2013/02/21/5; http://drupal.org/node/1916370
CVE: CVE-2013-0319
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1921340; http://drupal.org/node/1921342; http://drupal.org/node/1922400
CVE: CVE-2013-0320
Published: 2013-03-27
Description: Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1922168; http://drupal.org/node/1922170; http://drupal.org/node/1922410
CVE: CVE-2013-0321
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1922128; http://drupal.org/node/1922416; http://drupalcode.org/project/uc_views.git/commitdiff/157d5d3
CVE: CVE-2013-0322
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1922136; http://drupal.org/node/1922418; http://drupalcode.org/project/ubercart.git/commitdiff/f9d69b5
CVE: CVE-2013-0323
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1922424; http://drupal.org/node/1922430; http://drupal.org/node/1922438
CVE: CVE-2013-0324
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1922434; http://drupal.org/node/1922446; http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d
CVE: CVE-2013-0325
Published: 2013-03-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1922726; http://drupal.org/node/1922730; http://drupal.org/node/1922756
CVE: CVE-2013-1778
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Creative Theme 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1929380; http://drupal.org/node/1929474; http://drupalcode.org/project/creative.git/commitdiff/465367c
CVE: CVE-2013-1779
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1723316; http://drupal.org/node/1929482; http://drupalcode.org/project/fresh.git/commitdiff/08a3ccb
CVE: CVE-2013-1780
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1929390; http://drupal.org/node/1929484; http://drupalcode.org/project/best_responsive.git/commitdiff/5972126
CVE: CVE-2013-1781
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1730768; http://drupal.org/node/1929486; http://drupalcode.org/project/professional_theme.git/commitdiff/0640ddc
CVE: CVE-2013-1782
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1929396; http://drupal.org/node/1929488; http://drupalcode.org/project/responsive_blog.git/commitdiff/ce47de9
CVE: CVE-2013-1783
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1723246; http://drupal.org/node/1929496; http://drupalcode.org/project/business.git/commitdiff/02f081f
CVE: CVE-2013-1784
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1723532; http://drupal.org/node/1929500; http://drupalcode.org/project/clean_theme.git/commitdiff/697f839
CVE: CVE-2013-1785
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1730752; http://drupal.org/node/1929508; http://drupalcode.org/project/responsive.git/commitdiff/1c6fa91
CVE: CVE-2013-1786
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1724232; http://drupal.org/node/1929512; http://drupalcode.org/project/company.git/commitdiff/9ddac7e
CVE: CVE-2013-1787
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1730786; http://drupal.org/node/1929514; http://drupalcode.org/project/corporate.git/commitdiff/679a1d3
CVE: CVE-2013-1859
Published: 2013-03-27
Description: The Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the configuration options, which allows remote attackers to read and edit configuration options via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1942330; http://osvdb.org/91257; http://packetstormsecurity.com/files/120788/Drupal-Node-Parameter-Control-6.x-Access-Bypass.html
CVE: CVE-2013-2715
Published: 2013-03-27
Description: Cross-site scripting (XSS) vulnerability in the admin view in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupalcode.org/project/search_api.git/commitdiff/d22cf53; http://osvdb.org/89116; http://secunia.com/advisories/51806
CVE: CVE-2013-1887
Published: 2013-03-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1948354; http://drupal.org/node/1948358; http://drupalcode.org/project/views.git/commitdiff/ddf8181bd13f69ffbeeee14ae[PII_REDACTED]5d7ac
CVE: CVE-2013-0916
Published: 2013-03-28
Description: Use-after-free vulnerability in the Web Audio implementation in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=172342; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16665
CVE: CVE-2013-0917
Published: 2013-03-28
Description: The URL loader in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=180909; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15892
CVE: CVE-2013-0918
Published: 2013-03-28
Description: Google Chrome before 26.0.1410.43 does not prevent navigation to developer tools in response to a drag-and-drop operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=180555; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16520
CVE: CVE-2013-0919
Published: 2013-03-28
Description: Use-after-free vulnerability in Google Chrome before 26.0.1410.43 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the presence of an extension that creates a pop-up window.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=178760; http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html
CVE: CVE-2013-0920
Published: 2013-03-28
Description: Use-after-free vulnerability in the extension bookmarks API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=177410; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16552
CVE: CVE-2013-0921
Published: 2013-03-28
Description: The Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use of separate processes, which makes it easier for remote attackers to bypass intended access restrictions via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=174943; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16670
CVE: CVE-2013-0922
Published: 2013-03-28
Description: Google Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against web sites that require HTTP Basic Authentication, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=174129; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16215
CVE: CVE-2013-0923
Published: 2013-03-28
Description: The USB Apps API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=169765; https://code.google.com/p/chromium/issues/detail?id=169972
CVE: CVE-2013-0924
Published: 2013-03-28
Description: The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=169632; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16674
CVE: CVE-2013-0925
Published: 2013-03-28
Description: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; https://code.google.com/p/chromium/issues/detail?id=168442; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16363
CVE: CVE-2013-0926
Published: 2013-03-28
Description: Google Chrome before 26.0.1410.43 does not properly handle active content in an EMBED element during a copy-and-paste operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://git.chromium.org/gitweb/?p=chromium/src.git%3Ba=commit%3Bh=52a30db57ecec68bb3b25fdc3de5e9bee7b80ed7; http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2013/Jun/msg00001.html
CVE: CVE-2013-0935
Published: 2013-03-28
Description: EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0135.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0135.html
CVE: CVE-2013-0936
Published: 2013-03-28
Description: Cross-site scripting (XSS) vulnerability in EMC Smarts IP Manager, Smarts Service Assurance Manager, Smarts Server Manager, Smarts VoIP Availability Manager, Smarts Network Protocol Manager, and Smarts MPLS Manager before 9.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0152.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0152.html
CVE: CVE-2013-2717
Published: 2013-03-28
Description: Multiple unspecified vulnerabilities in the System Management (aka SysAdmin) Console in EMC Smarts Network Configuration Manager (NCM) through 9.2 have unknown impact and attack vectors, a different issue than CVE-2013-0935.  NOTE: this might overlap CVEs for open-source server components or other third-party components.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0135.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0135.html
CVE: CVE-2013-2266
Published: 2013-03-28
Description: libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://linux.oracle.com/errata/ELSA-2014-1244; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101500.html
CVE: CVE-2013-2494
Published: 2013-03-28
Description: libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service (memory consumption) via vectors involving a regular expression, as demonstrated by a memory-exhaustion attack against a machine running a dhcpd process, a related issue to CVE-2013-2266.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: https://kb.isc.org/article/AA-00880/; https://kb.isc.org/article/AA-00880/
CVE: CVE-2012-0553
Published: 2013-03-28
Description: Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html; http://secunia.com/advisories/52445; http://secunia.com/advisories/53372
CVE: CVE-2012-5216
Published: 2013-03-28
Description: Cross-site request forgery (CSRF) vulnerability on HP ProCurve 1700-8 (aka J9079A) switches with software before VA.02.09 and 1700-24 (aka J9080A) switches with software before VB.02.09 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN48108258/index.html; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03699981; http://jvn.jp/en/jp/JVN48108258/index.html
CVE: CVE-2012-5879
Published: 2013-03-28
Description: An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0143.html; http://osvdb.org/91700; http://www.securityfocus.com/bid/58750
CVE: CVE-2013-1142
Published: 2013-03-28
Description: Race condition in the VRF-aware NAT feature in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 allows remote attackers to cause a denial of service (memory consumption) via IPv4 packets, aka Bug IDs CSCtg47129 and CSCtz96745.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1142; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat
CVE: CVE-2013-1143
Published: 2013-03-28
Description: The RSVP protocol implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S, when MPLS-TE is enabled, allows remote attackers to cause a denial of service (incorrect memory access and device reload) via a traffic engineering PATH message in an RSVP packet, aka Bug ID CSCtg39957.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-rsvp; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1143; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-rsvp
CVE: CVE-2013-1144
Published: 2013-03-28
Description: Memory leak in the IKEv1 implementation in Cisco IOS 15.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified (1) IPv4 or (2) IPv6 IKE packets, aka Bug ID CSCth81055.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ike; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ike
CVE: CVE-2013-1145
Published: 2013-03-28
Description: Memory leak in Cisco IOS 12.2, 12.4, 15.0, and 15.1, when Zone-Based Policy Firewall SIP application layer gateway inspection is enabled, allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed SIP messages, aka Bug ID CSCtl99174.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-cce; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-cce