deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2466
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2468.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
CVE: CVE-2013-2467
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 5.0 Update 45 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Java installer.
CVSS Score: 6.9 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0971&w=2; http://secunia.com/advisories/54154; http://www-01.ibm.com/support/docview.wss?uid=swg21644197
CVE: CVE-2013-2468
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2442 and CVE-2013-2466.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
CVE: CVE-2013-2469
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D.
CVSS Score: 10.0 (HIGH)
References: http://advisories.mageia.org/MGASA-2013-0185.html; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=975120; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880
CVE: CVE-2013-2470
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing."
CVSS Score: 10.0 (HIGH)
References: http://advisories.mageia.org/MGASA-2013-0185.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880; http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/89d9ec9e80c1
CVE: CVE-2013-2471
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."
CVSS Score: 10.0 (HIGH)
References: http://advisories.mageia.org/MGASA-2013-0185.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880; http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/4c3d38927a26
CVE: CVE-2013-2472
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.
CVSS Score: 10.0 (HIGH)
References: http://advisories.mageia.org/MGASA-2013-0185.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880; http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/3cd4bec64e31
CVE: CVE-2013-2473
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D.
CVSS Score: 10.0 (HIGH)
References: http://advisories.mageia.org/MGASA-2013-0185.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880; http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/259d4998ce2f
CVE: CVE-2013-3743
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
CVSS Score: 9.3 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
CVE: CVE-2013-3744
Published: 2013-06-18
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2400.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0971&w=2
CVE: CVE-2013-0484
Published: 2013-06-19
Description: The server process in IBM Cognos TM1 10.1.x before 10.1.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via an undocumented API call that triggers the transmission of unexpected data.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637655; https://exchange.xforce.ibmcloud.com/vulnerabilities/81612; http://www-01.ibm.com/support/docview.wss?uid=swg21637655
CVE: CVE-2013-4622
Published: 2013-06-19
Description: The 3G Mobile Hotspot feature on the HTC Droid Incredible has a default WPA2 PSK passphrase of[PII_REDACTED], which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://support.verizonwireless.com/clc/devices/knowledge_base.html?id=35523; http://www1.cs.fau.de/filepool/projects/hotspot/hotspot.pdf; http://support.verizonwireless.com/clc/devices/knowledge_base.html?id=35523
CVE: CVE-2013-2968
Published: 2013-06-19
Description: An unspecified buffer-read method in IBM Sterling Control Center (SCC) 5.2 before 5.2.0.9, 5.3 before 5.3.0.4, and 5.4 through 5.4.0.1 allows remote authenticated users to cause a denial of service via a large file that lacks end-of-line characters.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640348; https://exchange.xforce.ibmcloud.com/vulnerabilities/83859; http://www-01.ibm.com/support/docview.wss?uid=swg21640348
CVE: CVE-2013-2969
Published: 2013-06-19
Description: Cross-site scripting (XSS) vulnerability in IBM Sterling Control Center (SCC) 5.2 before 5.2.0.9, 5.3 before 5.3.0.4, and 5.4 through 5.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving invalid characters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21640348; https://exchange.xforce.ibmcloud.com/vulnerabilities/83860; http://www-01.ibm.com/support/docview.wss?uid=swg21640348
CVE: CVE-2013-2866
Published: 2013-06-19
Description: The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html; http://googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html; http://habrahabr.ru/post/182706/
CVE: CVE-2013-1612
Published: 2013-06-20
Description: Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.1.3, and Symantec Endpoint Protection Center (SPC) Small Business Edition 12.0.x, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/60542; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20130618_00; http://www.securityfocus.com/bid/60542
CVE: CVE-2012-4960
Published: 2013-06-20
Description: The Huawei NE5000E, MA5200G, NE40E, NE80E, ATN, NE40, NE80, NE20E-X6, NE20, ME60, CX600, CX200, CX300, ACU, WLAN AC 6605, S9300, S7700, S2300, S3300, S5300, S3300HI, S5300HI, S5306, S6300, S2700, S3700, S5700, S6700, AR G3, H3C AR(OEM IN), AR 19, AR 29, AR 49, Eudemon100E, Eudemon200, Eudemon300, Eudemon500, Eudemon1000, Eudemon1000E-U/USG5300, Eudemon1000E-X/USG5500, Eudemon8080E/USG9300, Eudemon8160E/USG9300, Eudemon8000E-X/USG9500, E200E-C/USG2200, E200E-X3/USG2200, E200E-X5/USG2200, E200E-X7/USG2200, E200E-C/USG5100, E200E-X3/USG5100, E200E-X5/USG5100, E200E-X7/USG5100, E200E-B/USG2100, E200E-X1/USG2100, E200E-X2/USG2100, SVN5300, SVN2000, SVN5000, SVN3000, NIP100, NIP200, NIP1000, NIP2100, NIP2200, and NIP5100 use the DES algorithm for stored passwords, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194373.htm; http://www.kb.cert.org/vuls/id/948096; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194373.htm
CVE: CVE-2012-6568
Published: 2013-06-20
Description: Buffer overflow in the back-end component in Huawei UTPS 1.0 allows local users to gain privileges via a long IDS_PLUGIN_NAME string in a plug-in configuration file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.org/files/download/116604/huawei-overflow.txt; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-204627.htm; http://packetstormsecurity.org/files/download/116604/huawei-overflow.txt
CVE: CVE-2012-6569
Published: 2013-06-20
Description: Stack-based buffer overflow in the HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches allows remote attackers to execute arbitrary code via a long URI.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194370.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194370.htm
CVE: CVE-2012-6570
Published: 2013-06-20
Description: The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field, which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194361.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194361.htm
CVE: CVE-2012-6571
Published: 2013-06-20
Description: The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194371.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194371.htm
CVE: CVE-2013-4628
Published: 2013-06-20
Description: The firewall module on the Huawei Quidway Service Process Unit (SPU) board S7700, S9300, and S9700 on Huawei Campus Switch devices allows remote authenticated users to obtain sensitive information from the high-priority security zone by leveraging access to the low-priority security zone.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-261458.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-261458.htm
CVE: CVE-2013-4629
Published: 2013-06-20
Description: The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method.
CVSS Score: 8.5 (HIGH)
CWE: CWE-255
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-261327.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-261327.htm
CVE: CVE-2013-4630
Published: 2013-06-20
Description: Stack-based buffer overflow on Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 debugging is enabled, allows remote attackers to execute arbitrary code via malformed SNMPv3 requests.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/25295; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-260626.htm; http://www.exploit-db.com/exploits/25295
CVE: CVE-2013-4631
Published: 2013-06-20
Description: Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of service (device crash) via malformed SNMPv3 requests that leverage unspecified overflow issues.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-260601.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-260601.htm
CVE: CVE-2013-4632
Published: 2013-06-20
Description: The Huawei Access Router (AR) before V200R002SPC003 allows remote attackers to cause a denial of service (device reset) via a crafted field in a DHCP request, as demonstrated by a request from an IP phone.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258476.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258476.htm
CVE: CVE-2013-4633
Published: 2013-06-20
Description: Huawei Seco Versatile Security Manager (VSM) before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258449.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258449.htm
CVE: CVE-2013-1393
Published: 2013-06-20
Description: Cross-site scripting (XSS) vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/89571; http://packetstormsecurity.com/files/119766/Drupal-CurvyCorners-6.x-7.x-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/119814/CurvyCorners-Cross-Site-Scripting.html
CVE: CVE-2013-1905
Published: 2013-06-20
Description: Cross-site scripting (XSS) vulnerability in the Zero Point theme 7.x-1.x before 7.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1954588; http://osvdb.org/91745; http://packetstormsecurity.com/files/120985/Drupal-Zero-Point-7.x-Cross-Site-Scripting.html
CVE: CVE-2013-4634
Published: 2013-06-20
Description: SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/93815; http://secunia.com/advisories/53633; http://typo3.org/extensions/repository/view/rzautocomplete
CVE: CVE-2013-2173
Published: 2013-06-21
Description: wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0052.html; http://codex.wordpress.org/Version_3.5.2; http://openwall.com/lists/oss-security/2013/06/12/2
CVE: CVE-2013-3377
Published: 2013-06-21
Description: Cisco TelePresence TC Software before 5.1.7 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCue01743.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc
CVE: CVE-2013-3378
Published: 2013-06-21
Description: Cisco TelePresence TC Software before 6.1 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (temporary device hang) via crafted SIP packets, aka Bug ID CSCuf89557.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc
CVE: CVE-2013-3379
Published: 2013-06-21
Description: The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allows remote attackers to obtain shell access with root privileges by leveraging connectivity to the management network, aka Bug ID CSCts37781.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130619-tpc
CVE: CVE-2013-0527
Published: 2013-06-21
Description: The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not close pages upon the timeout of a session, which allows physically proximate attackers to obtain sensitive administrative-console information by reading the screen of an unattended workstation.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC90479; http://www-01.ibm.com/support/docview.wss?uid=swg21640356; https://exchange.xforce.ibmcloud.com/vulnerabilities/82609
CVE: CVE-2013-0529
Published: 2013-06-21
Description: The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC90478; http://www-01.ibm.com/support/docview.wss?uid=swg21640356; https://exchange.xforce.ibmcloud.com/vulnerabilities/82611
CVE: CVE-2013-0534
Published: 2013-06-21
Description: The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635218; https://exchange.xforce.ibmcloud.com/vulnerabilities/82656; http://www-01.ibm.com/support/docview.wss?uid=swg21635218
CVE: CVE-2013-3035
Published: 2013-06-21
Description: The IPv6 implementation in the inet subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allows remote attackers to cause a denial of service (system hang) via a crafted packet to an IPv6 interface.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://aix.software.ibm.com/aix/efixes/security/inet_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IV37925; http://www.ibm.com/support/docview.wss?uid=isg1IV42072
CVE: CVE-2013-0536
Published: 2013-06-21
Description: ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J24.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21633827; https://exchange.xforce.ibmcloud.com/vulnerabilities/82658; http://www-01.ibm.com/support/docview.wss?uid=swg21633827
CVE: CVE-2013-0548
Published: 2013-06-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192; http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187; http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115