deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3425
Published: 2014-05-08
Description: NCSA Mosaic 2.0 and earlier allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/xmosaic.pid file for every possible PID.
CVSS Score: 2.1 (LOW)
References: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html; http://openwall.com/lists/oss-security/2014/05/07/7; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html
CVE: CVE-2014-3426
Published: 2014-05-08
Description: NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/Mosaic.pid file for every possible PID.
CVSS Score: 2.1 (LOW)
References: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html; http://openwall.com/lists/oss-security/2014/05/07/7; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html
CVE: CVE-2012-5477
Published: 2014-05-08
Description: The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://projects.theforeman.org/issues/1929; http://theforeman.org/security.html; http://projects.theforeman.org/issues/1929
CVE: CVE-2013-0171
Published: 2014-05-08
Description: Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://projects.theforeman.org/issues/2069; http://theforeman.org/security.html; http://projects.theforeman.org/issues/2069
CVE: CVE-2013-0173
Published: 2014-05-08
Description: Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://projects.theforeman.org/issues/2069; http://theforeman.org/security.html; http://projects.theforeman.org/issues/2069
CVE: CVE-2013-0174
Published: 2014-05-08
Description: The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://projects.theforeman.org/issues/2069; http://theforeman.org/security.html; http://projects.theforeman.org/issues/2069
CVE: CVE-2013-0187
Published: 2014-05-08
Description: Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://theforeman.org/security.html; http://theforeman.org/security.html
CVE: CVE-2013-0210
Published: 2014-05-08
Description: The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://theforeman.org/security.html; http://theforeman.org/security.html
CVE: CVE-2013-0345
Published: 2014-05-08
Description: varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/02/22/14; http://www.openwall.com/lists/oss-security/2013/02/23/4; http://www.osvdb.org/90586
CVE: CVE-2013-3571
Published: 2014-05-08
Description: socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.
CVSS Score: 2.6 (LOW)
References: http://www.dest-unreach.org/socat/contrib/socat-secadv4.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:169; http://www.openwall.com/lists/oss-security/2013/05/26/1
CVE: CVE-2013-4544
Published: 2014-05-08
Description: hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3c99afc779c2c78718a565ad8c5e98de7c2c7484; http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8c6c0478996e8f77374e69b6df68655b0b4ba689; http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=9878d173f574df74bde0ff50b2f81009fbee81bb
CVE: CVE-2013-6372
Published: 2014-05-08
Description: The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: https://bugzilla.redhat.com/show_bug.cgi?id=1032391; https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20
CVE: CVE-2013-6889
Published: 2014-05-08
Description: GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.gnu.org.ua/gitweb?p=rush.git%3Ba=commit%3Bh=00bdccd429517f12dbf37ab4397ddec3e51a2738; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733505; http://git.gnu.org.ua/gitweb?p=rush.git%3Ba=commit%3Bh=00bdccd429517f12dbf37ab4397ddec3e51a2738
CVE: CVE-2013-7041
Published: 2014-05-08
Description: The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2013/12/09/16; http://www.openwall.com/lists/oss-security/2013/12/09/5; http://www.securityfocus.com/bid/64180
CVE: CVE-2014-0056
Published: 2014-05-08
Description: The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
CVSS Score: 2.1 (LOW)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2014-0516.html; http://www.openwall.com/lists/oss-security/2014/03/27/5; http://www.ubuntu.com/usn/USN-2194-1
CVE: CVE-2014-0090
Published: 2014-05-08
Description: Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://projects.theforeman.org/issues/4457; http://theforeman.org/security.html; https://bugzilla.redhat.com/show_bug.cgi?id=1072151
CVE: CVE-2014-0109
Published: 2014-05-08
Description: Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2014-1351.html; http://rhn.redhat.com/errata/RHSA-2015-0850.html; http://rhn.redhat.com/errata/RHSA-2015-0851.html
CVE: CVE-2014-0110
Published: 2014-05-08
Description: Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=[PII_REDACTED]28&api=v2; http://rhn.redhat.com/errata/RHSA-2014-1351.html; http://rhn.redhat.com/errata/RHSA-2015-0850.html
CVE: CVE-2014-0134
Published: 2014-05-08
Description: The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/03/27/6; http://www.ubuntu.com/usn/USN-2247-1; https://bugs.launchpad.net/nova/+bug/1221190
CVE: CVE-2014-0135
Published: 2014-05-08
Description: Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://theforeman.org/security.html; http://theforeman.org/security.html
CVE: CVE-2014-0190
Published: 2014-05-08
Description: The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html
CVE: CVE-2014-0192
Published: 2014-05-08
Description: Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://projects.theforeman.org/issues/5436; http://theforeman.org/security.html; https://bugzilla.redhat.com/show_bug.cgi?id=1092354
CVE: CVE-2014-1682
Published: 2014-05-08
Description: The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html; http://www.securityfocus.com/bid/65402
CVE: CVE-2014-1685
Published: 2014-05-08
Description: The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html; https://support.zabbix.com/browse/ZBX-7693
CVE: CVE-2014-1934
Published: 2014-05-08
Description: tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00027.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00028.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737062
CVE: CVE-2014-2689
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to installer/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/532048/100/0/threaded; http://www.securityfocus.com/bid/66657; https://www.htbridge.com/advisory/HTB23210
CVE: CVE-2014-3115
Published: 2014-05-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/May/30; http://www.fortiguard.com/advisory/FG-IR-14-013/; http://www.kb.cert.org/vuls/id/902790
CVE: CVE-2014-3123
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/58031; http://www.securityfocus.com/bid/67085; http://www.vapid.dhs.org/advisories/wordpress/plugins/nextCellent-gallery-1.9.13
CVE: CVE-2014-3207
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to pks/lookup/undefined1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57965; http://www.securityfocus.com/bid/67198; https://bitbucket.org/skskeyserver/sks-keyserver/commits/88d453cdc858d1352c61a4d4a6cd5b1ac17f2724
CVE: CVE-2013-5916
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0112.html; http://osvdb.org/97624; http://www.securityfocus.com/bid/62617
CVE: CVE-2014-2854
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability in the SemanticTitle extension before 1.1.0 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mediawiki.org/wiki/Extension:SemanticTitle#Version_1.1.0; http://www.mediawiki.org/wiki/Extension:SemanticTitle#Version_1.1.0
CVE: CVE-2014-0913
Published: 2014-05-09
Description: Cross-site scripting (XSS) vulnerability in IBM iNotes and Domino 8.5.3 FP6 before IF2 and 9.0.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via an e-mail message, aka SPR BFEY9GXHZE.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671981; http://www.securitytracker.com/id/1030215; https://exchange.xforce.ibmcloud.com/vulnerabilities/91880
CVE: CVE-2014-3214
Published: 2014-05-09
Description: The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://security.gentoo.org/glsa/glsa-201502-03.xml; http://www.securitytracker.com/id/1030214; https://kb.isc.org/article/AA-01161
CVE: CVE-2014-0944
Published: 2014-05-09
Description: Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671324; https://exchange.xforce.ibmcloud.com/vulnerabilities/92559; http://www-01.ibm.com/support/docview.wss?uid=swg21671324
CVE: CVE-2014-0945
Published: 2014-05-09
Description: Cross-site scripting (XSS) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671324; https://exchange.xforce.ibmcloud.com/vulnerabilities/92562; http://www-01.ibm.com/support/docview.wss?uid=swg21671324
CVE: CVE-2014-0946
Published: 2014-05-09
Description: The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671324; https://exchange.xforce.ibmcloud.com/vulnerabilities/92573; http://www-01.ibm.com/support/docview.wss?uid=swg21671324
CVE: CVE-2014-1991
Published: 2014-05-09
Description: Open redirect vulnerability in WebPlatform / AppFramework 6.0 through 7.2 in NTT DATA INTRAMART intra-mart allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN68340046/278948/index.html; http://jvn.jp/en/jp/JVN68340046/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000044
CVE: CVE-2013-6220
Published: 2014-05-10
Description: Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0, 9.10, and 9.20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1030218; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04273695; http://www.securitytracker.com/id/1030218
CVE: CVE-2014-2603
Published: 2014-05-10
Description: Unspecified vulnerability on HP 8/20q switches, SN6000 switches, and 8Gb Simple SAN Connection Kit with firmware before 8.0.14.08.00 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 1.7 (LOW)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04277407; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04277407
CVE: CVE-2014-1737
Published: 2014-05-11
Description: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-754
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ef87dbe7614341c2e7bfe8d32fcb7028cc97442c; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3043.html
CVE: CVE-2014-1738
Published: 2014-05-11
Description: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2145e15e0557a01b9195d1c7199a1b92cb9be81f; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3043.html
CVE: CVE-2014-3122
Published: 2014-05-11
Description: The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=57e68e9cd65b4b8eb4045a1e0d[PII_REDACTED]554c; http://secunia.com/advisories/59386; http://secunia.com/advisories/59599
CVE: CVE-2014-3144
Published: 2014-05-11
Description: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05ab8f2647e4221cbdb3856dd7d32bd5407316b3; http://linux.oracle.com/errata/ELSA-2014-3052.html; http://secunia.com/advisories/58990
CVE: CVE-2014-3145
Published: 2014-05-11
Description: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05ab8f2647e4221cbdb3856dd7d32bd5407316b3; http://linux.oracle.com/errata/ELSA-2014-3052.html; http://secunia.com/advisories/58990
CVE: CVE-2013-4570
Published: 2014-05-12
Description: The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; https://bugzilla.wikimedia.org/show_bug.cgi?id=54527; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-4571
Published: 2014-05-12
Description: Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-4574
Published: 2014-05-12
Description: Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-4577
Published: 2014-05-12
Description: A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/291; http://seclists.org/oss-sec/2013/q4/292; http://www.openwall.com/lists/oss-security/2024/01/15/3
CVE: CVE-2013-4580
Published: 2014-05-12
Description: GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/11/15/4; https://www.gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab/; http://www.openwall.com/lists/oss-security/2013/11/15/4