deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-3870
Published: 2013-09-11
Description: Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspx; http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspx; http://www.us-cert.gov/ncas/alerts/TA13-253A
CVE: CVE-2013-3351
Published: 2013-09-12
Description: Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18447; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3352
Published: 2013-09-12
Description: Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3354 and CVE-2013-3355.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18590; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3353
Published: 2013-09-12
Description: Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-3356.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18369; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3354
Published: 2013-09-12
Description: Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3352 and CVE-2013-3355.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18948; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3355
Published: 2013-09-12
Description: Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3352 and CVE-2013-3354.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18826; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3356
Published: 2013-09-12
Description: Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-3353.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18932; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3357
Published: 2013-09-12
Description: Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-3358.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19064; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3358
Published: 2013-09-12
Description: Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-3357.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.adobe.com/support/security/bulletins/apsb13-22.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18969; http://www.adobe.com/support/security/bulletins/apsb13-22.html
CVE: CVE-2013-3359
Published: 2013-09-12
Description: Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3360.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-23.html; http://www.adobe.com/support/security/bulletins/apsb13-23.html
CVE: CVE-2013-3360
Published: 2013-09-12
Description: Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3359.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-23.html; http://www.adobe.com/support/security/bulletins/apsb13-23.html
CVE: CVE-2013-3361
Published: 2013-09-12
Description: Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3362, CVE-2013-3363, and CVE-2013-5324.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html
CVE: CVE-2013-3362
Published: 2013-09-12
Description: Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3361, CVE-2013-3363, and CVE-2013-5324.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html
CVE: CVE-2013-3363
Published: 2013-09-12
Description: Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3361, CVE-2013-3362, and CVE-2013-5324.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html
CVE: CVE-2013-5324
Published: 2013-09-12
Description: Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3361, CVE-2013-3362, and CVE-2013-3363.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html
CVE: CVE-2013-3036
Published: 2013-09-12
Description: Open redirect vulnerability in IBM Rational Requirements Composer before 4.0.4 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645927; https://exchange.xforce.ibmcloud.com/vulnerabilities/84688; http://www-01.ibm.com/support/docview.wss?uid=swg21645927
CVE: CVE-2013-3037
Published: 2013-09-12
Description: Unspecified vulnerability in IBM Rational Requirements Composer before 4.0.4 makes it easier for local users to gain privileges via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645927; https://exchange.xforce.ibmcloud.com/vulnerabilities/84689; http://www-01.ibm.com/support/docview.wss?uid=swg21645927
CVE: CVE-2013-3038
Published: 2013-09-12
Description: Unspecified vulnerability in IBM Rational Requirements Composer before 4.0.4 makes it easier for remote attackers to discover credentials via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645927; https://exchange.xforce.ibmcloud.com/vulnerabilities/84708; http://www-01.ibm.com/support/docview.wss?uid=swg21645927
CVE: CVE-2013-3039
Published: 2013-09-12
Description: IBM Rational Requirements Composer before 4.0.4 does not properly perform authentication, which has unspecified impact and remote attack vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645927; https://exchange.xforce.ibmcloud.com/vulnerabilities/84709; http://www-01.ibm.com/support/docview.wss?uid=swg21645927
CVE: CVE-2013-3446
Published: 2013-09-12
Description: Open redirect vulnerability in the login page in Cisco Digital Media Manager (DMM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCub23849.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3446; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3446
CVE: CVE-2013-5488
Published: 2013-09-12
Description: Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ component, which allows remote attackers to cause a denial of service (memory consumption) via simultaneous TCP sessions, aka Bug IDs CSCuh54766, CSCuh01267, CSCuh95976, and CSCuh95969.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5488; http://tools.cisco.com/security/center/viewAlert.x?alertId=30749; http://www.securityfocus.com/bid/62333
CVE: CVE-2013-4338
Published: 2013-09-12
Description: wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://codex.wordpress.org/Version_3.6.1; http://core.trac.wordpress.org/changeset/25325; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
CVE: CVE-2013-4339
Published: 2013-09-12
Description: WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://codex.wordpress.org/Version_3.6.1; http://core.trac.wordpress.org/changeset/25323; http://core.trac.wordpress.org/changeset/25324
CVE: CVE-2013-4340
Published: 2013-09-12
Description: wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.6.1; http://core.trac.wordpress.org/changeset/25321; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
CVE: CVE-2013-5738
Published: 2013-09-12
Description: The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://codex.wordpress.org/Version_3.6.1; http://core.trac.wordpress.org/changeset/25322; http://wordpress.org/news/2013/09/wordpress-3-6-1/
CVE: CVE-2013-5739
Published: 2013-09-12
Description: The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.6.1; http://core.trac.wordpress.org/changeset/25322; http://wordpress.org/news/2013/09/wordpress-3-6-1/
CVE: CVE-2013-4307
Published: 2013-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow (1) remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section or (2) remote administrators to inject arbitrary web script or HTML via a description.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html; http://osvdb.org/96907; http://seclists.org/oss-sec/2013/q3/553
CVE: CVE-2013-4308
Published: 2013-09-12
Description: Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html; http://osvdb.org/96906; http://seclists.org/oss-sec/2013/q3/553
CVE: CVE-2013-5723
Published: 2013-09-12
Description: SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/96900; http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/54702
CVE: CVE-2013-5724
Published: 2013-09-12
Description: Phpbb3 before 3.0.11-4 for Debian GNU/Linux uses world-writable permissions for cache files, which allows local users to modify the file contents via standard filesystem write operations.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711172; http://secunia.com/advisories/54665; http://www.debian.org/security/2013/dsa-2752
CVE: CVE-2013-2601
Published: 2013-09-12
Description: The NDVM in Citrix XenClient XT before 2.1.3 and 3.x before 3.1.4 allows remote attackers to execute arbitrary commands by using the UIVM to create a network connection.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/96749; http://support.citrix.com/article/CTX138633; https://exchange.xforce.ibmcloud.com/vulnerabilities/86967
CVE: CVE-2013-2933
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2934
Published: 2013-09-12
Description: Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 does not properly restrict access to web services, which has unspecified impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2935
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2936
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2937
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, related to debugging messages, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2938
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2939
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-2940
Published: 2013-09-12
Description: Unspecified vulnerability in Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 has unknown impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX137162; http://support.citrix.com/article/CTX137162
CVE: CVE-2013-4329
Published: 2013-09-12
Description: The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.xen.org/archives/html/xen-devel/2013-07/msg00066.html; http://security.gentoo.org/glsa/glsa-201407-03.xml
CVE: CVE-2013-5216
Published: 2013-09-12
Description: Directory traversal vulnerability in logreader/uploadreader.jsp in CapaSystems Performance Guard before 6.2.102 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0186.html; http://capawiki.capasystems.com/display/pgdoc/PG+6.2.102; http://secunia.com/advisories/54688
CVE: CVE-2013-5740
Published: 2013-09-12
Description: Unspecified vulnerability in the Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) before 1.2, as used by the Intel QM77, QS77, Q77 Express, C216, Q67 Express, C202, C204, and C206 chipsets and Mobile Intel QM67 and QS67 chipsets, when the measured launch environment (MLE) is invoked, allows local users to bypass the Trusted Execution Technology protection mechanism and perform other unspecified SINIT ACM functions via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
References: http://support.citrix.com/article/CTX138633; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00035&languageid=en-fr; http://support.citrix.com/article/CTX138633
CVE: CVE-2013-4705
Published: 2013-09-13
Description: Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN01094166/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000086; http://www.opera.com/docs/changelogs/unified/1500/
CVE: CVE-2013-5482
Published: 2013-09-13
Description: Cisco Prime LAN Management Solution (LMS) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCug77823.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5482; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5482
CVE: CVE-2013-5489
Published: 2013-09-13
Description: The gadget implementation in Cisco SocialMiner does not properly restrict the content of GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuh74125.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5489; http://tools.cisco.com/security/center/viewAlert.x?alertId=30734; https://exchange.xforce.ibmcloud.com/vulnerabilities/86965
CVE: CVE-2013-5492
Published: 2013-09-13
Description: administration.jsp in Cisco SocialMiner allows remote attackers to obtain sensitive information by sniffing the network for HTTP client-server traffic, aka Bug ID CSCuh76780.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5492; http://www.securitytracker.com/id/1029033; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5492