deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3909
Published: 2013-11-13
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18342
CVE: CVE-2013-3910
Published: 2013-11-13
Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19109
CVE: CVE-2013-3911
Published: 2013-11-13
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19265
CVE: CVE-2013-3912
Published: 2013-11-13
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3916.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19182
CVE: CVE-2013-3914
Published: 2013-11-13
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18893
CVE: CVE-2013-3915
Published: 2013-11-13
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3917.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19243
CVE: CVE-2013-3916
Published: 2013-11-13
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3912.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18488
CVE: CVE-2013-3917
Published: 2013-11-13
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3915.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19138
CVE: CVE-2013-3940
Published: 2013-11-13
Description: Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image in a Windows Write (.wri) document, which is not properly handled in WordPad, aka "Graphics Device Interface Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-089; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18722
CVE: CVE-2013-6789
Published: 2013-11-13
Description: security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/bugtraq/2013/Aug/12; https://github.com/chillu/silverstripe-framework/commit/3e88c98ca513880e2b43ed7f27ade17fef5d9170; http://seclists.org/bugtraq/2013/Aug/12
CVE: CVE-2013-5326
Published: 2013-11-13
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the logviewer directory.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.adobe.com/support/security/bulletins/apsb13-27.html; http://www.kb.cert.org/vuls/id/295276; http://www.adobe.com/support/security/bulletins/apsb13-27.html
CVE: CVE-2013-5328
Published: 2013-11-13
Description: Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.adobe.com/support/security/bulletins/apsb13-27.html; http://www.adobe.com/support/security/bulletins/apsb13-27.html
CVE: CVE-2013-5329
Published: 2013-11-13
Description: Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, Adobe AIR before 3.9.0.1210, Adobe AIR SDK before 3.9.0.1210, and Adobe AIR SDK & Compiler before 3.9.0.1210 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-5330.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00019.html
CVE: CVE-2013-5330
Published: 2013-11-13
Description: Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, Adobe AIR before 3.9.0.1210, Adobe AIR SDK before 3.9.0.1210, and Adobe AIR SDK & Compiler before 3.9.0.1210 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-5329.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00019.html
CVE: CVE-2013-2931
Published: 2013-11-13
Description: Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-4475
Published: 2013-11-13
Description: Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html; http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.html
CVE: CVE-2013-4476
Published: 2013-11-13
Description: Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
CVSS Score: 1.2 (LOW)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.html; http://security.gentoo.org/glsa/glsa-201502-15.xml
CVE: CVE-2013-5378
Published: 2013-11-13
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.x before 8.0.0.1 CF8 allows remote authenticated users to inject arbitrary web script or HTML by leveraging incorrect IBM Connections integration.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95802; http://www-01.ibm.com/support/docview.wss?uid=swg1PM95881; http://www-01.ibm.com/support/docview.wss?uid=swg1PM97593
CVE: CVE-2013-5379
Published: 2013-11-13
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.x before 7.0.0.2 CF25 and 8.x before 8.0.0.1 CF8 allows remote authenticated users to inject arbitrary web script or HTML by leveraging improper tagging functionality.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM96047; http://www-01.ibm.com/support/docview.wss?uid=swg21655635; https://exchange.xforce.ibmcloud.com/vulnerabilities/86930
CVE: CVE-2013-5442
Published: 2013-11-13
Description: Cross-site scripting (XSS) vulnerability in the Local Management Interface (LMI) in IBM Security Network Protection on XGS 5100 devices with firmware 5.1 before 5.1.0.6 and 5.1.1 before 5.1.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655377; http://www.securityfocus.com/bid/63642; https://exchange.xforce.ibmcloud.com/vulnerabilities/87818
CVE: CVE-2013-5450
Published: 2013-11-13
Description: IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensitive information or modify data by leveraging an improperly protected URL to obtain a session token.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655578; https://exchange.xforce.ibmcloud.com/vulnerabilities/88190; http://www-01.ibm.com/support/docview.wss?uid=swg21655578
CVE: CVE-2013-5453
Published: 2013-11-13
Description: IBM Security AppScan Enterprise 5.6 through 8.7.0.1 allows remote authenticated users to read arbitrary report files by leveraging knowledge of filenames that cannot be easily predicted.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655578; https://exchange.xforce.ibmcloud.com/vulnerabilities/88193; http://www-01.ibm.com/support/docview.wss?uid=swg21655578
CVE: CVE-2013-5552
Published: 2013-11-13
Description: Cisco IOS 12.4(24)MDB9 and earlier on Content Services Gateway (CSG) devices does not properly implement the "parse error drop" feature, which allows remote attackers to bypass intended access restrictions via a crafted series of packets, aka Bug ID CSCug90143.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5552; http://tools.cisco.com/security/center/viewAlert.x?alertId=31715; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5552
CVE: CVE-2013-5560
Published: 2013-11-13
Description: The IPv6 implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1.3 and earlier, when NAT64 or NAT66 is enabled, does not properly process NAT rules, which allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCue34342.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5560; http://tools.cisco.com/security/center/viewAlert.x?alertId=31716; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5560
CVE: CVE-2013-5568
Published: 2013-11-13
Description: The auto-update implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier allows remote attackers to cause a denial of service (device reload) via crafted update data, aka Bug ID CSCui33308.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5568; http://tools.cisco.com/security/center/viewAlert.x?alertId=31693; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5568
CVE: CVE-2013-5990
Published: 2013-11-13
Description: Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6, 7, and 2006 through 2010; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen and Gen Trial Edition; Ichitaro Pro; Ichitaro Pro 2 and Pro 2 Trial Edition; Ichitaro Viewer; and Ichitaro Portable with oreplug allows remote attackers to execute arbitrary code via a crafted document.
CVSS Score: 9.3 (HIGH)
References: http://jvn.jp/en/jp/JVN44999463/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000103; http://www.justsystems.com/jp/info/js13003.html
CVE: CVE-2013-6357
Published: 2013-11-13
Description: Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt; http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt
CVE: CVE-2013-6621
Published: 2013-11-13
Description: Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6622
Published: 2013-11-13
Description: Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the movement of a media element between documents.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6623
Published: 2013-11-13
Description: The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order, rather than transitive dependency order, for layout.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6624
Published: 2013-11-13
Description: Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6625
Published: 2013-11-13
Description: Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
CVE: CVE-2013-6626
Published: 2013-11-13
Description: The WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 31.0.1650.48 does not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6627
Published: 2013-11-13
Description: net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
CVE: CVE-2013-6628
Published: 2013-11-13
Description: net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.
CVSS Score: 4.3 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
CVE: CVE-2013-6682
Published: 2013-11-13
Description: The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 certificates, which allows remote attackers to cause a denial of service (connection-database corruption) via an invalid entry, aka Bug ID CSCui33299.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6682; http://tools.cisco.com/security/center/viewAlert.x?alertId=31692; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6682
CVE: CVE-2013-6683
Published: 2013-11-13
Description: The IPv6 implementation in Cisco NX-OS does not properly handle neighbor-table adjacencies, which allows remote attackers to cause a denial of service (NS processing outage) via a series of malformed packets, aka Bug ID CSCtd15904.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6683; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6683
CVE: CVE-2013-6684
Published: 2013-11-13
Description: The web framework on Cisco Wireless LAN Controller (WLC) devices does not properly validate configuration parameters, which allows remote authenticated users to cause a denial of service via a crafted HTTP request, aka Bug ID CSCuh81011.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6684; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6684
CVE: CVE-2013-6685
Published: 2013-11-13
Description: The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gain privileges by mounting a device with a setuid file in its filesystem, aka Bug ID CSCui04382.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6685; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6685
CVE: CVE-2013-6780
Published: 2013-11-13
Description: Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2013/11/25/1; http://packetstormsecurity.com/files/130527/Cisco-Ironport-AsyncOS-Cross-Site-Scripting.html; http://www.securitytracker.com/id/1029528
CVE: CVE-2013-6058
Published: 2013-11-14
Description: SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to blog-by-cat/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0026.html; http://packetstormsecurity.com/files/123929; http://www.exploit-db.com/exploits/29514
CVE: CVE-2013-6163
Published: 2013-11-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to view/parameter.php, (2) p1value parameter to view/main.php, or (3) objectClass parameter to view/objectDetail.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0021.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0032.html; http://osvdb.org/99366