deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1222
Published: 2013-05-09
Description: The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38379.
CVSS Score: 7.8 (HIGH)
CWE: CWE-16
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
CVE: CVE-2013-1223
Published: 2013-05-09
Description: The log viewer in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38372.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
CVE: CVE-2013-1224
Published: 2013-05-09
Description: Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted (1) HTTP or (2) HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
CVE: CVE-2013-1225
Published: 2013-05-09
Description: Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager (1) HTTP or (2) HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCub38366.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp
CVE: CVE-2013-1611
Published: 2013-05-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in administrative-interface pages in the management console in Symantec Brightmail Gateway 9.5.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/59700; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130508_00; http://www.securityfocus.com/bid/59700
CVE: CVE-2013-2308
Published: 2013-05-09
Description: The (1) OWA Helper and (2) OSG Lite programs in SoftBank Online Service Gate allow remote authenticated users to discover their own passwords, and consequently bypass an Office 365 restriction, via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN61972596/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000035; https://www.softbanktech.jp/news/20121029.html
CVE: CVE-2013-3336
Published: 2013-05-09
Description: Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.adobe.com/support/security/advisories/apsa13-03.html; http://www.adobe.com/support/security/bulletins/apsb13-13.html; http://www.exploit-db.com/exploits/25305
CVE: CVE-2013-0518
Published: 2013-05-10
Description: IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21636369; https://exchange.xforce.ibmcloud.com/vulnerabilities/83128; http://www-01.ibm.com/support/docview.wss?uid=swg21636369
CVE: CVE-2013-0519
Published: 2013-05-10
Description: IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in (1) an unspecified page title and (2) an unspecified HTTP header field, which allows remote attackers to obtain potentially sensitive information by reading a version string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21636369; https://exchange.xforce.ibmcloud.com/vulnerabilities/82654; http://www-01.ibm.com/support/docview.wss?uid=swg21636369
CVE: CVE-2013-0520
Published: 2013-05-10
Description: IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java stack-trace information by providing invalid input data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21636369; https://exchange.xforce.ibmcloud.com/vulnerabilities/83433; http://www-01.ibm.com/support/docview.wss?uid=swg21636369
CVE: CVE-2013-0578
Published: 2013-05-10
Description: The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8.0 before HF128 and IBM Sterling Selling and Fulfillment Foundation 8.5 before HF93, 9.0 before HF73, 9.1.0 before FP45, and 9.2.0 before FP17, when the API tester is enabled, do not require administrative credentials, which allows remote authenticated users to obtain sensitive database information via a request to the API tester URI.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC91829; http://www-01.ibm.com/support/docview.wss?uid=swg21636034; https://exchange.xforce.ibmcloud.com/vulnerabilities/83330
CVE: CVE-2013-0937
Published: 2013-05-10
Description: Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html
CVE: CVE-2013-0938
Published: 2013-05-10
Description: Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html
CVE: CVE-2013-0939
Published: 2013-05-10
Description: EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation, related to a "Cross Frame Scripting" issue.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0037.html
CVE: CVE-2013-0946
Published: 2013-05-10
Description: Buffer overflow in the Library Control Program (LCP) in EMC AlphaStor 4.0 before build 910 allows remote attackers to execute arbitrary code via crafted commands.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0035.html; http://www.securityfocus.com/bid/59794; https://www.exploit-db.com/exploits/42719/
CVE: CVE-2013-1242
Published: 2013-05-10
Description: Memory leak in the web framework in the server in Cisco Unified Presence (CUP) allows remote attackers to cause a denial of service (memory consumption) via malformed TCP packets, aka Bug ID CSCug38080.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1242; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1242
CVE: CVE-2013-2707
Published: 2013-05-10
Description: Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52950; http://wordpress.org/extend/plugins/login-with-ajax/changelog/; http://secunia.com/advisories/52950
CVE: CVE-2013-2977
Published: 2013-05-10
Description: Integer overflow in IBM Notes 8.5.x before 8.5.3 FP4 Interim Fix 1 and 9.x before 9.0 Interim Fix 1 on Windows, and 8.5.x before 8.5.3 FP5 and 9.x before 9.0.1 on Linux, allows remote attackers to execute arbitrary code via a malformed PNG image in a previewed e-mail message, aka SPR NPEI96K82Q.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635878; https://exchange.xforce.ibmcloud.com/vulnerabilities/83967; http://www-01.ibm.com/support/docview.wss?uid=swg21635878
CVE: CVE-2013-3254
Published: 2013-05-10
Description: Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53105; http://wordpress.org/extend/plugins/wp-photo-album-plus/changelog/; http://secunia.com/advisories/53105
CVE: CVE-2012-6552
Published: 2013-05-10
Description: Unspecified vulnerability in admin/action.php in phpVMS 2.1.x before 2.1.935 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://forum.phpvms.net/topic/7842-security-fix-released-for-21x/; https://github.com/nshahzad/phpVMS/commit/7303aa072061388eba06f0c5a701c688096ebccc; http://forum.phpvms.net/topic/7842-security-fix-released-for-21x/
CVE: CVE-2013-3522
Published: 2013-05-10
Description: SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/24882; http://www.osvdb.org/92031; http://www.exploit-db.com/exploits/24882
CVE: CVE-2013-3523
Published: 2013-05-10
Description: SQL injection vulnerability in This HTML Is Simple (THIS) before 1.2.4 allows remote to execute arbitrary SQL commands via vectors related to op=page&id= in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://freecode.com/projects/this/releases/353516; http://osvdb.org/91976; http://xforce.iss.net/xforce/xfdb/84168
CVE: CVE-2013-3524
Published: 2013-05-10
Description: SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/53033; http://www.exploit-db.com/exploits/24960; http://www.osvdb.org/92328
CVE: CVE-2013-3525
Published: 2013-05-10
Description: SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter.  NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.bestpractical.com/2013/04/on-our-security-policies.html; http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://osvdb.org/92265
CVE: CVE-2013-3526
Published: 2013-05-10
Description: Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/92197; http://packetstormsecurity.com/files/121167/WordPress-Traffic-Analyzer-Cross-Site-Scripting.html; http://secunia.com/advisories/52929
CVE: CVE-2013-3527
Published: 2013-05-10
Description: Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0068.html; http://mfs-enterprise.com/wordpress/2013/04/05/vanilla-forums-2-0-18-sql-injection-insert-arbitrary-user-dump-usertable/; http://osvdb.org/92109
CVE: CVE-2013-3528
Published: 2013-05-10
Description: Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."
CVSS Score: 7.5 (HIGH)
References: http://vanillaforums.org/discussion/23339/security-update-vanilla-2-0-18-7; https://exchange.xforce.ibmcloud.com/vulnerabilities/84167; https://github.com/vanillaforums/Garden/commit/b9a10dabb15c697347bfa7baef69a6e211b2f804
CVE: CVE-2013-3529
Published: 2013-05-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/121030/WordPress-FuneralPress-1.1.6-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-funeral-press&old=690038&new_path=%2Fwp-funeral-press&new=690038; http://seclists.org/fulldisclosure/2013/Mar/282
CVE: CVE-2013-3530
Published: 2013-05-10
Description: SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92258; http://packetstormsecurity.com/files/121204/WordPress-Spiffy-XSPF-Player-0.1-SQL-Injection.html; http://www.securityfocus.com/bid/58976
CVE: CVE-2013-3531
Published: 2013-05-10
Description: SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92088; http://packetstormsecurity.com/files/121091/Radio-CMS-2.2-SQL-Injection.html; http://www.securityfocus.com/bid/58884
CVE: CVE-2013-3532
Published: 2013-05-10
Description: SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92264; http://packetstormsecurity.com/files/121250/WordPress-Spider-Video-Player-2.1-SQL-Injection.html; http://packetstormsecurity.com/files/128851/WordPress-HTML5-Flash-Player-SQL-Injection.html
CVE: CVE-2013-3533
Published: 2013-05-10
Description: Multiple SQL injection vulnerabilities in Virtual Access Monitor 3.10.17 and earlier allow attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0011.html; http://osvdb.org/91887; http://packetstormsecurity.com/files/121051/Virtual-Access-Monitor-SQL-Injection.html
CVE: CVE-2013-1136
Published: 2013-05-13
Description: The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory, which allows local users to cause a denial of service (route processor crash) by creating multiple tunnels and then examining encryption statistics, aka Bug ID CSCuc52193.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1136; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1136
CVE: CVE-2013-1897
Published: 2013-05-13
Description: The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101323.html; http://rhn.redhat.com/errata/RHSA-2013-0742.html; https://bugzilla.redhat.com/show_bug.cgi?id=928105
CVE: CVE-2013-1917
Published: 2013-05-13
Description: Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2013-1918
Published: 2013-05-13
Description: Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105533.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/53187
CVE: CVE-2013-1919
Published: 2013-05-13
Description: Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104538.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2013-1922
Published: 2013-05-13
Description: qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103621.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103637.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104036.html
CVE: CVE-2013-1940
Published: 2013-05-13
Description: X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102391.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104089.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00015.html
CVE: CVE-2013-1952
Published: 2013-05-13
Description: Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105533.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://osvdb.org/92984
CVE: CVE-2013-2020
Published: 2013-05-13
Description: Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://blog.clamav.net/2013/04/clamav-0978-has-been-released.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
CVE: CVE-2013-2021
Published: 2013-05-13
Description: pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://blog.clamav.net/2013/04/clamav-0978-has-been-released.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
CVE: CVE-2013-3534
Published: 2013-05-13
Description: Cross-site scripting (XSS) vulnerability in the aiContactSafe component before 2.0.21 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53050; http://www.algisinfo.com/en/home-bottom/41-xss-in-aicontactsafe.html; http://www.securityfocus.com/bid/59266
CVE: CVE-2013-3535
Published: 2013-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_email, (2) header_title, (3) site_title parameter to admin/settings; (4) recaptcha_private or (5) recaptcha_public parameter to admin/captcha_settings; (6) fb_appid, (7) fp_secret, (8) tw_consumer_key, or (9) tw_consumer_secret parameter to admin/social_settings; (10) slug parameter to admin/gallery/save_item_settings; or (11) item_link parameter to admin/edit_menu_item_ajax.  NOTE: this issue might be resultant from CSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://osvdb.org/92322; http://osvdb.org/92323
CVE: CVE-2013-3536
Published: 2013-05-13
Description: SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/121046/WHMCS-Grouppay-1.5-SQL-Injection.html; http://secunia.com/advisories/52804; http://www.exploit-db.com/exploits/24934
CVE: CVE-2013-3537
Published: 2013-05-13
Description: Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_post or (2) pg parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92318; http://packetstormsecurity.com/files/121290/Todoo-Forum-2.0-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/59069