deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1132
Published: 2013-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) IptAccountMgmt, (2) IptFeatureConfigTemplateMgmt, (3) IptFeatureDisplayPolicyMgmt, or (4) IptProviderMgmt page, aka Bug IDs CSCud69972, CSCud70193, and CSCud70261.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1132; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1132
CVE: CVE-2013-3408
Published: 2013-07-10
Description: The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to gain privileges via an unspecified sequence of commands, aka Bug ID CSCuc31764.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3408; http://www.securitytracker.com/id/1028764; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3408
CVE: CVE-2013-3416
Published: 2013-07-10
Description: Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Operations Manager and Unified Service Monitor allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuh47574 and CSCuh95997.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3416; http://www.securitytracker.com/id/1028765; http://www.securitytracker.com/id/1028766
CVE: CVE-2013-3579
Published: 2013-07-10
Description: The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.lookout.security.ScanTell with zero arguments.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/704828; http://www.kb.cert.org/vuls/id/704828
CVE: CVE-2013-2352
Published: 2013-07-10
Description: LeftHand OS (aka SAN iQ) 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support challenge-response root-login feature, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an unused one-time password.
CVSS Score: 9.4 (HIGH)
CWE: CWE-255
References: http://www.theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors/; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03825537; http://www.theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors/
CVE: CVE-2013-2784
Published: 2013-07-10
Description: Triangle Research International (aka Tri) Nano-10 PLC devices with firmware before r81 use an incorrect algorithm for bounds checking of data in Modbus/TCP packets, which allows remote attackers to cause a denial of service (networking outage) via a crafted packet to TCP port 502.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-189-02; http://ics-cert.us-cert.gov/advisories/ICSA-13-189-02
CVE: CVE-2013-2786
Published: 2013-07-10
Description: Alstom Grid MiCOM S1 Agile before 1.0.3 and Alstom Grid MiCOM S1 Studio use weak permissions for the MiCOM S1 %PROGRAMFILES% directory, which allows local users to gain privileges via a Trojan horse executable file.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-184-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-184-01
CVE: CVE-2013-4684
Published: 2013-07-11
Description: flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R8, 12.1 before 12.1R7, and 12.1X44 before 12.1X44-D15 on SRX devices, when PIM and NAT are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted PIM packets, aka PR 842253.
CVSS Score: 7.8 (HIGH)
References: http://kb.juniper.net/JSA10573; http://osvdb.org/95107; http://secunia.com/advisories/54157
CVE: CVE-2013-4685
Published: 2013-07-11
Description: Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code via crafted HTTP requests, aka PR 849100.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://kb.juniper.net/JSA10574; http://osvdb.org/95108; http://www.securityfocus.com/bid/61125
CVE: CVE-2013-4686
Published: 2013-07-11
Description: The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows remote attackers to cause a denial of service (device crash) via a crafted ARP request, aka PR 842091.
CVSS Score: 7.1 (HIGH)
References: http://kb.juniper.net/JSA10576; http://secunia.com/advisories/54119; http://www.securityfocus.com/bid/61126
CVE: CVE-2013-4687
Published: 2013-07-11
Description: flowd in Juniper Junos 10.4 before 10.4S14, 11.2 and 11.4 before 11.4R6-S2, and 12.1 before 12.1R6 on SRX devices, when certain Application Layer Gateways (ALGs) are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted TCP packets, aka PRs 727980, 806269, and 835593.
CVSS Score: 7.8 (HIGH)
References: http://kb.juniper.net/JSA10577; http://www.securityfocus.com/bid/61122; http://kb.juniper.net/JSA10577
CVE: CVE-2013-4688
Published: 2013-07-11
Description: flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices, when the MSRPC Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted MSRPC requests, aka PR 772834.
CVSS Score: 7.8 (HIGH)
References: http://kb.juniper.net/JSA10578; http://www.securityfocus.com/bid/61124; http://kb.juniper.net/JSA10578
CVE: CVE-2013-4690
Published: 2013-07-11
Description: Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data, aka PR 829536, a related issue to CVE-2003-0001.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/JSA10579; http://osvdb.org/95112; http://www.securityfocus.com/bid/61123
CVE: CVE-2013-1768
Published: 2013-07-11
Description: The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html; http://rhn.redhat.com/errata/RHSA-2013-1862.html; http://svn.apache.org/viewvc?view=revision&revision=1462076
CVE: CVE-2013-1777
Published: 2013-07-11
Description: The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0008.html; http://geronimo.apache.org/30x-security-report.html; http://www-01.ibm.com/support/docview.wss?uid=swg21643282
CVE: CVE-2013-3418
Published: 2013-07-11
Description: Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests, which allows remote authenticated users to cause a denial of service (memory consumption and process crash) via crafted requests to the management interface, aka Bug ID CSCud22922.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3418; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3418
CVE: CVE-2013-3419
Published: 2013-07-11
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh74981.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3419; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3419
CVE: CVE-2013-2687
Published: 2013-07-12
Description: Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/qnxph_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01; http://www.qnx.com/download/feature.html?programid=24850
CVE: CVE-2013-2688
Published: 2013-07-12
Description: Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868 that leverage improper handling of the /dev/photon device file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/qnxph_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01; http://www.qnx.com/download/feature.html?programid=24850
CVE: CVE-2013-3655
Published: 2013-07-12
Description: The Sharp AQUOS PhotoPlayer HN-PP150 with firmware before 1.04.00.04 allows remote attackers to cause a denial of service (networking outage) via crafted packet data.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/en/jp/JVN68773685/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000068; http://www.sharp.co.jp/support/photoplayer/fw_update.html
CVE: CVE-2013-2704
Published: 2013-07-12
Description: Cross-site request forgery (CSRF) vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52958; http://wordpress.org/plugins/dropdown-menu-widget/changelog/; http://secunia.com/advisories/52958
CVE: CVE-2013-3421
Published: 2013-07-12
Description: Cross-site scripting (XSS) vulnerability in the Help index page in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3421; https://exchange.xforce.ibmcloud.com/vulnerabilities/85622; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3421
CVE: CVE-2013-3422
Published: 2013-07-12
Description: Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75165.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3422; https://exchange.xforce.ibmcloud.com/vulnerabilities/85623; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3422
CVE: CVE-2013-3423
Published: 2013-07-12
Description: Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCud75174.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3423; https://exchange.xforce.ibmcloud.com/vulnerabilities/85624; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3423
CVE: CVE-2013-3424
Published: 2013-07-12
Description: Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System (ACS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCud75177.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3424; https://exchange.xforce.ibmcloud.com/vulnerabilities/85625; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3424
CVE: CVE-2013-2351
Published: 2013-07-13
Description: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.00, 9.1x, and 9.2x allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03747342; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03747342
CVE: CVE-2013-3692
Published: 2013-07-13
Description: BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass intended access restrictions by leveraging a user's BlackBerry Protect password-reset request and a user's installation of a crafted application.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://www.blackberry.com/btsc/KB34458; https://exchange.xforce.ibmcloud.com/vulnerabilities/85878; http://www.blackberry.com/btsc/KB34458
CVE: CVE-2013-4113
Published: 2013-07-13
Description: ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=7d163e8a0880ae8af2dd869071393e5dc07ef271; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html
CVE: CVE-2013-2765
Published: 2013-07-15
Description: The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0125.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
CVE: CVE-2013-3428
Published: 2013-07-15
Description: The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3428; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3428
CVE: CVE-2013-1087
Published: 2013-07-15
Description: Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/kb/doc.php?id=7012063; https://bugzilla.novell.com/show_bug.cgi?id=799673; http://www.novell.com/support/kb/doc.php?id=7012063
CVE: CVE-2013-3577
Published: 2013-07-15
Description: SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/217836; http://www.kb.cert.org/vuls/id/217836
CVE: CVE-2013-3578
Published: 2013-07-15
Description: SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to execution of operating-system commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78, CWE-89
References: http://www.kb.cert.org/vuls/id/217836; http://www.kb.cert.org/vuls/id/217836
CVE: CVE-2013-4125
Published: 2013-07-15
Description: The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes, which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=307f2fb95e9b96b3577916e73d92e104f8f26494; http://lists.fedoraproject.org/pipermail/package-announce/2013-July/112454.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-July/112619.html
CVE: CVE-2013-1935
Published: 2013-07-16
Description: A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2013-0911.html; https://bugzilla.redhat.com/show_bug.cgi?id=949981; https://rhn.redhat.com/errata/RHSA-2013-0907.html
CVE: CVE-2013-1943
Published: 2013-07-16
Description: The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa3d315a4ce2c0891cdde262562e710d95fba19e; http://web.archive.org/web/[PII_REDACTED]0349/http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0; http://www.ubuntu.com/usn/USN-1939-1
CVE: CVE-2013-2188
Published: 2013-07-16
Description: A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle failure to obtain write permissions, which allows local users to cause a denial of service (system crash) by leveraging access to a filesystem that is mounted read-only.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=975406; https://bugzilla.redhat.com/show_bug.cgi?id=975406
CVE: CVE-2013-3491
Published: 2013-07-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Sharebar plugin 1.2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) modify buttons, or (3) insert cross-site scripting (XSS) sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52948; http://www.securityfocus.com/bid/60956; https://exchange.xforce.ibmcloud.com/vulnerabilities/85438
CVE: CVE-2013-4117
Published: 2013-07-16
Description: Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://exploit.iedb.ir/exploits-177.html; http://openwall.com/lists/oss-security/2013/07/11/11; http://osvdb.org/94805
CVE: CVE-2013-0245
Published: 2013-07-16
Description: The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://osvdb.org/89305; http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html; http://seclists.org/fulldisclosure/2013/Jan/120
CVE: CVE-2013-0246
Published: 2013-07-16
Description: The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html; http://seclists.org/fulldisclosure/2013/Jan/120; http://seclists.org/oss-sec/2013/q1/211
CVE: CVE-2013-1907
Published: 2013-07-16
Description: The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/91748; http://packetstormsecurity.com/files/120991/Drupal-Common-Groups-7.x-Access-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2013/Mar/242
CVE: CVE-2013-1908
Published: 2013-07-16
Description: The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/91747; http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2013/Mar/244
CVE: CVE-2013-1925
Published: 2013-07-16
Description: The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://osvdb.org/91986; http://packetstormsecurity.com/files/121072/Drupal-Chaos-Tool-Suite-7.x-Access-Bypass.html; http://seclists.org/fulldisclosure/2013/Apr/8
CVE: CVE-2013-2122
Published: 2013-07-16
Description: The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/93725; http://seclists.org/fulldisclosure/2013/May/208; http://secunia.com/advisories/53556