deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6164
Published: 2013-11-14
Description: SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrary SQL commands via the objectId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0020.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0031.html; http://osvdb.org/99367
CVE: CVE-2013-6168
Published: 2013-11-14
Description: Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0057.html; http://community.zikula.org/index.php?module=News&func=display&sid=3132; http://www.securityfocus.com/bid/63186
CVE: CVE-2013-6226
Published: 2013-11-14
Description: Directory traversal vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0043.html; http://pyd.io/pydio-core-5-0-4; http://www.redfsec.com/CVE-2013-6226
CVE: CVE-2013-6793
Published: 2013-11-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote attackers to inject arbitrary web script or HTML via the (1) event name or (2) date field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99075; http://packetstormsecurity.com/files/123825/Olat-CMS-7.8.0.1-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2013/Oct/154
CVE: CVE-2013-6794
Published: 2013-11-14
Description: Cross-site scripting (XSS) vulnerability in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allows remote attackers to inject arbitrary web script or HTML via the Location field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55423; http://secunia.com/advisories/55423
CVE: CVE-2013-1057
Published: 2013-11-18
Description: Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/55567; http://ubuntu.com/usn/usn-2013-1; https://bugs.launchpad.net/maas/+bug/1158425
CVE: CVE-2013-2031
Published: 2013-11-18
Description: MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html
CVE: CVE-2013-2032
Published: 2013-11-18
Description: MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html
CVE: CVE-2013-2061
Published: 2013-11-18
Description: The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html
CVE: CVE-2013-2114
Published: 2013-11-18
Description: Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-May/000131.html; http://secunia.com/advisories/55433; http://security.gentoo.org/glsa/glsa-201310-21.xml
CVE: CVE-2013-4204
Published: 2013-11-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.gwtproject.org/release-notes.html#Release_Notes_2_5_1_RC1; http://www.openwall.com/lists/oss-security/2013/08/05/1; http://www.openwall.com/lists/oss-security/2013/08/05/3
CVE: CVE-2013-4425
Published: 2013-11-18
Description: The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" as the hardcoded password, which allows local users to obtain the private key.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0029.html; http://osvdb.org/99518; http://www.securityfocus.com/bid/63566
CVE: CVE-2013-4480
Published: 2013-11-18
Description: Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.html; http://rhn.redhat.com/errata/RHSA-2013-1513.html; http://rhn.redhat.com/errata/RHSA-2013-1514.html
CVE: CVE-2013-4510
Published: 2013-11-18
Description: Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://hg.tryton.org/tryton/rev/357d0a4d9cb8; http://www.debian.org/security/2013/dsa-2791; http://www.openwall.com/lists/oss-security/2013/11/04/21
CVE: CVE-2013-4551
Published: 2013-11-18
Description: Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html; http://secunia.com/advisories/55398; http://security.gentoo.org/glsa/glsa-201407-03.xml
CVE: CVE-2013-4555
Published: 2013-11-18
Description: Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://core.spip.org/projects/spip/repository/revisions/20874; http://secunia.com/advisories/55551; http://www.openwall.com/lists/oss-security/2013/11/10/4
CVE: CVE-2013-4556
Published: 2013-11-18
Description: Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://core.spip.org/projects/spip/repository/revisions/20879; http://core.spip.org/projects/spip/repository/revisions/20880; http://secunia.com/advisories/55551
CVE: CVE-2013-4557
Published: 2013-11-18
Description: The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/55551; http://www.openwall.com/lists/oss-security/2013/11/10/4; http://www.securitytracker.com/id/1029317
CVE: CVE-2013-5193
Published: 2013-11-18
Description: The App Store component in Apple iOS before 7.0.4 does not properly enforce an intended transaction-time password requirement, which allows local users to complete a (1) App purchase or (2) In-App purchase by leveraging previous entry of Apple ID credentials.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2013/Nov/msg00000.html; http://support.apple.com/kb/HT6058; http://lists.apple.com/archives/security-announce/2013/Nov/msg00000.html
CVE: CVE-2013-6798
Published: 2013-11-18
Description: BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended restrictions on remote file-access folders via IPv6 WebDAV requests, a different vulnerability than CVE-2013-3694.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.blackberry.com/btsc/KB35315; https://exchange.xforce.ibmcloud.com/vulnerabilities/89202; http://www.blackberry.com/btsc/KB35315
CVE: CVE-2013-6799
Published: 2013-11-18
Description: Apple Mac OS X 10.9 allows local users to cause a denial of service (memory corruption or panic) by creating a hard link to a directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0105.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0033.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0051.html; http://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2013-6800
Published: 2013-11-18
Description: An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418.
CVSS Score: 4.0 (MEDIUM)
References: http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757; http://www.securityfocus.com/bid/63770; https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d
CVE: CVE-2013-1418
Published: 2013-11-18
Description: The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2013-0335.html; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757; http://lists.opensuse.org/opensuse-updates/2013-11/msg00082.html
CVE: CVE-2013-3030
Published: 2013-11-18
Description: The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service (temporary gateway outage) via crafted HTTP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652590; https://exchange.xforce.ibmcloud.com/vulnerabilities/84592; http://www-01.ibm.com/support/docview.wss?uid=swg21652590
CVE: CVE-2013-3406
Published: 2013-11-18
Description: The "Files Available for Download" implementation in the Cisco Intelligent Automation for Cloud component in Cisco Services Portal 9.4(1) allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCug65687.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3406; http://tools.cisco.com/security/center/viewAlert.x?alertId=31775; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3406
CVE: CVE-2013-3407
Published: 2013-11-18
Description: The web interface in Cisco Server Provisioner 6.4.0 Patch 5[PII_REDACTED] and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3407; http://tools.cisco.com/security/center/viewAlert.x?alertId=31776; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3407
CVE: CVE-2013-3694
Published: 2013-11-18
Description: BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.cmpxchg8b.com/2013/11/qnx.html; http://www.blackberry.com/btsc/KB35315; http://blog.cmpxchg8b.com/2013/11/qnx.html
CVE: CVE-2013-3876
Published: 2013-11-18
Description: DirectAccess in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify server X.509 certificates, which allows man-in-the-middle attackers to spoof servers and read encrypted domain credentials via a crafted certificate.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://technet.microsoft.com/security/advisory/2862152; http://technet.microsoft.com/security/advisory/2862152
CVE: CVE-2013-4034
Published: 2013-11-18
Description: IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21652590; https://exchange.xforce.ibmcloud.com/vulnerabilities/86137; http://www-01.ibm.com/support/docview.wss?uid=swg21652590
CVE: CVE-2013-4842
Published: 2013-11-18
Description: Cross-site scripting (XSS) vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03996804; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03996804
CVE: CVE-2013-4843
Published: 2013-11-18
Description: Unspecified vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03996804; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03996804
CVE: CVE-2013-5425
Published: 2013-11-18
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Virtual Enterprise 6.1 before 6.1.1.6 and 7.0 before 7.0.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM93828; http://www-01.ibm.com/support/docview.wss?uid=swg21652405; https://exchange.xforce.ibmcloud.com/vulnerabilities/87487
CVE: CVE-2013-5454
Published: 2013-11-18
Description: IBM WebSphere Portal 6.0 through 6.0.1.7, 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF25, and 8.0 through 8.0.0.1 CF08 allows remote attackers to read arbitrary files via a modified URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM99205; http://www-01.ibm.com/support/docview.wss?uid=swg21655656; https://exchange.xforce.ibmcloud.com/vulnerabilities/88253
CVE: CVE-2013-5556
Published: 2013-11-18
Description: The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for VMware vSphere, Cisco Nexus 1000V switch 5.2(1)SM1(5.1) for Microsoft Hyper-V, and Cisco Virtual Security Gateway 4.2(1)VSG1(1) for Nexus 1000V switches allows local users to gain privileges and execute arbitrary commands via crafted "install all iso" arguments, aka Bug ID CSCui21340.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5556; http://tools.cisco.com/security/center/viewAlert.x?alertId=31774; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5556
CVE: CVE-2013-6686
Published: 2013-11-18
Description: The SSL VPN implementation in Cisco IOS 15.3(1)T2 and earlier allows remote authenticated users to cause a denial of service (interface queue wedge) via crafted DTLS packets in an SSL session, aka Bug IDs CSCuh97409 and CSCud90568.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6686; http://tools.cisco.com/security/center/viewAlert.x?alertId=31757; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6686
CVE: CVE-2013-6688
Published: 2013-11-18
Description: Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager (ELM) component in Cisco Unified Communications Manager 9.1(1) and earlier allows remote authenticated users to create arbitrary files via a crafted path, aka Bug ID CSCui58222.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6688; http://tools.cisco.com/security/center/viewAlert.x?alertId=31759; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6688
CVE: CVE-2013-6689
Published: 2013-11-18
Description: Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or create arbitrary files, via an "overload" of the command-line utility, aka Bug ID CSCui58229.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6689; http://tools.cisco.com/security/center/viewAlert.x?alertId=31758; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6689
CVE: CVE-2013-1741
Published: 2013-11-18
Description: Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
CVE: CVE-2013-4006
Published: 2013-11-18
Description: IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21651880; http://www-01.ibm.com/support/docview.wss?uid=swg1PM90472; https://exchange.xforce.ibmcloud.com/vulnerabilities/85273
CVE: CVE-2013-5414
Published: 2013-11-18
Description: The migration functionality in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 does not properly support the distinction between the admin role and the adminsecmanager role, which allows remote authenticated users to gain privileges in opportunistic circumstances by accessing resources in between a migration and a role evaluation.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21651880; http://www-01.ibm.com/support/docview.wss?uid=swg1PM92313; https://exchange.xforce.ibmcloud.com/vulnerabilities/87476
CVE: CVE-2013-5417
Published: 2013-11-18
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote attackers to inject arbitrary web script or HTML via HTTP response data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21651880; http://www-01.ibm.com/support/docview.wss?uid=swg1PM93323; http://www-01.ibm.com/support/docview.wss?uid=swg1PM93944
CVE: CVE-2013-5418
Published: 2013-11-18
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21651880; http://www-01.ibm.com/support/docview.wss?uid=swg1PM96477; http://www.securityfocus.com/bid/63778
CVE: CVE-2013-5605
Published: 2013-11-18
Description: Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00078.html
CVE: CVE-2013-5606
Published: 2013-11-18
Description: The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html
CVE: CVE-2013-5972
Published: 2013-11-18
Description: VMware Workstation 9.x before 9.0.3 and VMware Player 5.x before 5.0.3 on Linux do not properly handle shared libraries, which allows host OS users to gain host OS privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.vmware.com/security/advisories/VMSA-2013-0013.html; http://www.vmware.com/security/advisories/VMSA-2013-0013.html