deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6074
Published: 2013-02-24
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb; http://www.openwall.com/lists/oss-security/2012/12/28/1
CVE: CVE-2013-0158
Published: 2013-02-24
Description: Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
CVSS Score: 2.6 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cb; http://www.openwall.com/lists/oss-security/2013/01/07/4
CVE: CVE-2013-0164
Published: 2013-02-24
Description: The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; https://bugzilla.redhat.com/show_bug.cgi?id=893307; https://github.com/openshift/origin-server/commit/524465f70a32d0eb6bf047e6a05c76c22d52bfa2
CVE: CVE-2013-1138
Published: 2013-02-25
Description: The NAT process on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (connections-table memory consumption) via crafted packets, aka Bug ID CSCue46386.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1138; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1138
CVE: CVE-2012-3499
Published: 2013-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://httpd.apache.org/security/vulnerabilities_22.html; http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2012-4558
Published: 2013-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://httpd.apache.org/security/vulnerabilities_22.html; http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
CVE: CVE-2013-0504
Published: 2013-02-27
Description: Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html
CVE: CVE-2013-0643
Published: 2013-02-27
Description: The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html
CVE: CVE-2013-0648
Published: 2013-02-27
Description: Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html
CVE: CVE-2013-1139
Published: 2013-02-27
Description: The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCud81134.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1139; http://tools.cisco.com/security/center/viewAlert.x?alertId=28387; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1139
CVE: CVE-2012-5767
Published: 2013-02-27
Description: Unspecified vulnerability in the web interface on the IBM TS3500 Tape Library with firmware before C260 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004282; https://exchange.xforce.ibmcloud.com/vulnerabilities/80272; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004282
CVE: CVE-2013-2276
Published: 2013-02-27
Description: The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted audio data.
CVSS Score: 7.5 (HIGH)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8a6449167a6da8cb747cfe3502ae86ffaac2ed48; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8a6449167a6da8cb747cfe3502ae86ffaac2ed48
CVE: CVE-2013-2277
Published: 2013-02-27
Description: The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.
CVSS Score: 7.5 (HIGH)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=bdeb61ccc67911cfc5e20c7cfb1312d0501ca90a; http://www.ubuntu.com/usn/USN-1790-1; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=bdeb61ccc67911cfc5e20c7cfb1312d0501ca90a
CVE: CVE-2012-4842
Published: 2013-02-27
Description: Open redirect vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21614077; https://exchange.xforce.ibmcloud.com/vulnerabilities/79232; http://www-01.ibm.com/support/docview.wss?uid=swg21614077
CVE: CVE-2012-4844
Published: 2013-02-27
Description: Cross-site scripting (XSS) vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21614077; https://exchange.xforce.ibmcloud.com/vulnerabilities/79233; http://www-01.ibm.com/support/docview.wss?uid=swg21614077
CVE: CVE-2013-0490
Published: 2013-02-27
Description: Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626276; https://exchange.xforce.ibmcloud.com/vulnerabilities/81948; http://www-01.ibm.com/support/docview.wss?uid=swg21626276
CVE: CVE-2013-1133
Published: 2013-02-27
Description: Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports, aka Bug ID CSCtx43337.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm
CVE: CVE-2013-1134
Published: 2013-02-27
Description: The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm
CVE: CVE-2013-1135
Published: 2013-02-27
Description: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443, aka Bug ID CSCuc07155.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-hcs; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1135; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-hcs
CVE: CVE-2013-1137
Published: 2013-02-27
Description: Cisco Unified Presence Server (CUPS) 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port, aka Bug ID CSCua89930.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cups; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cups
CVE: CVE-2012-4542
Published: 2013-02-28
Description: block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]5813&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]6042&w=2; http://rhn.redhat.com/errata/RHSA-2013-0496.html
CVE: CVE-2013-0343
Published: 2013-02-28
Description: The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.
CVSS Score: 3.2 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://openwall.com/lists/oss-security/2012/12/05/4; http://openwall.com/lists/oss-security/2013/01/16/7
CVE: CVE-2013-0349
Published: 2013-02-28
Description: The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0a9ab9bdb3e891762553f667066190c1d22ad62b; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6
CVE: CVE-2013-1763
Published: 2013-02-28
Description: Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00004.html; http://openwall.com/lists/oss-security/2013/02/25/12
CVE: CVE-2013-1767
Published: 2013-02-28
Description: Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f00110f7273f9ff04ac69a5f85bb535a4fd0987; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2013-1772
Published: 2013-02-28
Description: The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.33; http://www.openwall.com/lists/oss-security/2013/02/26/9
CVE: CVE-2013-1773
Published: 2013-02-28
Description: Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://rhn.redhat.com/errata/RHSA-2013-0928.html
CVE: CVE-2013-1774
Published: 2013-02-28
Description: The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1ee0a224bc9aad1de496c795f96bc6ba2c394811; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2013-1124
Published: 2013-02-28
Description: The Cisco Network Admission Control (NAC) agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine (ISE) server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1124; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1124
CVE: CVE-2013-1141
Published: 2013-02-28
Description: The mDNS snooping functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.4.1.54 and earlier does not properly manage buffers, which allows remote authenticated users to cause a denial of service (device reload) via crafted mDNS packets, aka Bug ID CSCue04153.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1141; http://tools.cisco.com/security/center/viewAlert.x?alertId=28417; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1141
CVE: CVE-2012-1568
Published: 2013-03-01
Description: The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
CVSS Score: 1.9 (LOW)
References: http://openwall.com/lists/oss-security/2012/03/21/3; http://scarybeastsecurity.blogspot.com/2012/03/some-random-observations-on-linux-aslr.html; http://www.openwall.com/lists/oss-security/2012/03/20/4
CVE: CVE-2012-5561
Published: 2013-03-01
Description: script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-0544.html; http://rhn.redhat.com/errata/RHSA-2013-0547.html; https://bugzilla.redhat.com/show_bug.cgi?id=879094
CVE: CVE-2012-5604
Published: 2013-03-01
Description: The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0544.html; https://bugzilla.redhat.com/show_bug.cgi?id=882136; http://rhn.redhat.com/errata/RHSA-2013-0544.html
CVE: CVE-2012-6109
Published: 2013-03-01
Description: lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
CVSS Score: 4.3 (MEDIUM)
References: http://rack.github.com/; http://rhn.redhat.com/errata/RHSA-2013-0544.html; http://rhn.redhat.com/errata/RHSA-2013-0548.html
CVE: CVE-2012-6116
Published: 2013-03-01
Description: modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0547.html; http://rhn.redhat.com/errata/RHSA-2013-0686.html; http://secunia.com/advisories/52774
CVE: CVE-2013-0162
Published: 2013-03-01
Description: The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0544.html; http://rhn.redhat.com/errata/RHSA-2013-0548.html; https://bugzilla.redhat.com/show_bug.cgi?id=892806
CVE: CVE-2013-0183
Published: 2013-03-01
Description: multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html; http://rack.github.com/; http://rhn.redhat.com/errata/RHSA-2013-0544.html
CVE: CVE-2013-0184
Published: 2013-03-01
Description: Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html; http://rhn.redhat.com/errata/RHSA-2013-0544.html; http://rhn.redhat.com/errata/RHSA-2013-0548.html
CVE: CVE-2013-0256
Published: 2013-03-01
Description: darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html
CVE: CVE-2013-0707
Published: 2013-03-01
Description: Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006 and 2007, Ichitaro Portable with oreplug, Hanako 2006 through 2013, Hanako Police, Hanako Police 3, and Hanako Police 2010 allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
References: http://jvn.jp/en/jp/JVN16817324/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000015; http://www.justsystems.com/jp/info/js13001.html
CVE: CVE-2013-0708
Published: 2013-03-01
Description: Cross-site scripting (XSS) vulnerability in dopvCOMET* 0009b allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN64756004/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000013; http://tech.bayashi.net/dc/
CVE: CVE-2013-0709
Published: 2013-03-01
Description: Cross-site scripting (XSS) vulnerability in dopvSTAR* 0091 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN36339873/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000014; http://tech.bayashi.net/ds/
CVE: CVE-2011-1019
Published: 2013-03-01
Description: The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 1.9 (LOW)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8909c9ad8ff03611c9c96c9a92656213e4bb495b; http://www.openwall.com/lists/oss-security/2011/02/25/1
CVE: CVE-2011-1182
Published: 2013-03-01
Description: kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.
CVSS Score: 3.6 (LOW)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=da48524eb[PII_REDACTED]4bb3df2db01fc65f3070c; http://rhn.redhat.com/errata/RHSA-2011-0927.html