deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4048
Published: 2013-09-16
Description: Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving addition of script to a page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648929; https://exchange.xforce.ibmcloud.com/vulnerabilities/86441; http://www-01.ibm.com/support/docview.wss?uid=swg21648929
CVE: CVE-2013-4049
Published: 2013-09-16
Description: Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to execute arbitrary code by uploading and accessing a JSP file.
CVSS Score: 8.5 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648929; https://exchange.xforce.ibmcloud.com/vulnerabilities/86442; http://www-01.ibm.com/support/docview.wss?uid=swg21648929
CVE: CVE-2013-5369
Published: 2013-09-16
Description: IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg21648929; https://exchange.xforce.ibmcloud.com/vulnerabilities/86657; http://www-01.ibm.com/support/docview.wss?uid=swg21648929
CVE: CVE-2013-1439
Published: 2013-09-16
Description: The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
CVSS Score: 4.3 (MEDIUM)
References: http://www.debian.org/security/2013/dsa-2748; http://www.openwall.com/lists/oss-security/2013/08/29/3; https://github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad
CVE: CVE-2013-1441
Published: 2013-09-16
Description: econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonscm.debian.org/gitweb/?p=collab-maint/exactimage.git%3Ba=commitdiff%3Bh=1dff2eb586a3d10d8528a984bc471292e3789f5c%3Bhp=acfe54193b18b46e880f4b474d2e40b4fdb44a8d; http://www.debian.org/security/2013/dsa-2754; http://www.openwall.com/lists/oss-security/2013/09/05/8
CVE: CVE-2013-2256
Published: 2013-09-16
Description: OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-1199.html; http://seclists.org/oss-sec/2013/q3/281; https://bugs.launchpad.net/nova/+bug/1194093
CVE: CVE-2013-4123
Published: 2013-09-16
Description: client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00024.html; http://secunia.com/advisories/54142; http://secunia.com/advisories/54834
CVE: CVE-2013-4132
Published: 2013-09-16
Description: KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00082.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html; http://seclists.org/oss-sec/2013/q3/117
CVE: CVE-2013-4179
Published: 2013-09-16
Description: The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2013-1199.html; http://www.ubuntu.com/usn/USN-2005-1; https://bugs.launchpad.net/ossa/+bug/1190229
CVE: CVE-2013-4180
Published: 2013-09-16
Description: The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://projects.theforeman.org/issues/2860; http://rhn.redhat.com/errata/RHSA-2013-1196.html; http://theforeman.org/manuals/1.2/index.html#Releasenotesfor1.2.2
CVE: CVE-2013-4181
Published: 2013-09-16
Description: Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-1210.html; https://bugzilla.redhat.com/show_bug.cgi?id=988774; http://rhn.redhat.com/errata/RHSA-2013-1210.html
CVE: CVE-2013-4182
Published: 2013-09-16
Description: app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://projects.theforeman.org/issues/2863; http://rhn.redhat.com/errata/RHSA-2013-1196.html; http://theforeman.org/manuals/1.2/index.html#Releasenotesfor1.2.2
CVE: CVE-2013-4183
Published: 2013-09-16
Description: The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-1198.html; http://www.ubuntu.com/usn/USN-2005-1; https://bugs.launchpad.net/cinder/+bug/1198185
CVE: CVE-2013-4202
Published: 2013-09-16
Description: The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2013-1198.html; http://www.ubuntu.com/usn/USN-2005-1; https://bugs.launchpad.net/ossa/+bug/1190229
CVE: CVE-2013-4233
Published: 2013-09-16
Description: Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted P header in an ABC file, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://blog.scrt.ch/2013/07/24/vlc-abc-parsing-seems-to-be-a-ctf-challenge/; http://secunia.com/advisories/54388; http://secunia.com/advisories/54695
CVE: CVE-2013-4234
Published: 2013-09-16
Description: Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://blog.scrt.ch/2013/07/24/vlc-abc-parsing-seems-to-be-a-ctf-challenge/; http://secunia.com/advisories/54388; http://secunia.com/advisories/54695
CVE: CVE-2013-4259
Published: 2013-09-16
Description: runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://www.ansible.com/security; https://bugzilla.redhat.com/show_bug.cgi?id=998223; https://groups.google.com/forum/#%21topic/ansible-project/UVDYW0HGcNg
CVE: CVE-2013-4260
Published: 2013-09-16
Description: lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://www.ansible.com/security; https://bugzilla.redhat.com/show_bug.cgi?id=998227; https://exchange.xforce.ibmcloud.com/vulnerabilities/86898
CVE: CVE-2013-4277
Published: 2013-09-16
Description: Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00031.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00054.html; http://subversion.apache.org/security/CVE-2013-4277-advisory.txt
CVE: CVE-2013-4278
Published: 2013-09-16
Description: The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.  NOTE: this issue is due to an incomplete fix for CVE-2013-2256.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html; http://rhn.redhat.com/errata/RHSA-2013-1199.html; https://bugs.launchpad.net/ossa/+bug/1212179
CVE: CVE-2013-4315
Published: 2013-09-16
Description: Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html; http://rhn.redhat.com/errata/RHSA-2013-1521.html; http://secunia.com/advisories/54772
CVE: CVE-2013-5650
Published: 2013-09-16
Description: Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote attackers to cause a denial of service (device hang) via a crafted packet.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/97241; http://secunia.com/advisories/54776; https://exchange.xforce.ibmcloud.com/vulnerabilities/87063
CVE: CVE-2013-5751
Published: 2013-09-16
Description: Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://en.securitylab.ru/lab/PT-2012-24; http://osvdb.org/97350; http://scn.sap.com/docs/DOC-8218
CVE: CVE-2012-4067
Published: 2013-09-17
Description: Walrus in Eucalyptus before 3.2.2 allows remote attackers to cause a denial of service (memory, thread, and CPU consumption) via a crafted XML message containing a DTD, as demonstrated by a bucket-logging request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.eucalyptus.com/resources/security/advisories/esa-09; https://eucalyptus.atlassian.net/browse/EUCA-5277; http://www.eucalyptus.com/resources/security/advisories/esa-09
CVE: CVE-2013-2296
Published: 2013-09-17
Description: Walrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus, SetBucketLoggingStatus, and SetBucketVersioningStatus bucket operations, which allows remote authenticated users to bypass intended restrictions on (1) modifying the logging setting, (2) modifying the versioning setting, or (3) accessing activity logs via a request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.eucalyptus.com/resources/security/advisories/esa-10; https://eucalyptus.atlassian.net/browse/EUCA-3074; http://www.eucalyptus.com/resources/security/advisories/esa-10
CVE: CVE-2013-2297
Published: 2013-09-17
Description: Eucalyptus EuStore sets a blank root password in the default configuration of EMI[PII_REDACTED], EMI[PII_REDACTED], EMI[PII_REDACTED], and EMI[PII_REDACTED], which allows local users to gain privileges via unspecified vectors, a related issue to CVE-2013-2069.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-255
References: http://www.eucalyptus.com/resources/security/advisories/esa-12; http://www.eucalyptus.com/resources/security/advisories/esa-12
CVE: CVE-2013-4766
Published: 2013-09-17
Description: The gather log service in Eucalyptus before 3.3.1 allows remote attackers to read log files via an unspecified request to the (1) Cluster Controller (CC) or (2) Node Controller (NC) component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.eucalyptus.com/resources/security/advisories/esa-13; http://www.eucalyptus.com/resources/security/advisories/esa-13
CVE: CVE-2013-5711
Published: 2013-09-17
Description: Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0055.html; http://wordpress.org/plugins/design-approval-system/other_notes/; http://archives.neohapsis.com/archives/bugtraq/2013-09/0055.html
CVE: CVE-2013-2788
Published: 2013-09-17
Description: The DNP3 Slave service in SUBNET Solutions SubSTATION Server 2.7.0033 and 2.8.0106 allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-252-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-252-01
CVE: CVE-2013-3612
Published: 2013-09-17
Description: Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/800094; http://www.kb.cert.org/vuls/id/800094
CVE: CVE-2013-3613
Published: 2013-09-17
Description: Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/800094; http://www.kb.cert.org/vuls/id/800094
CVE: CVE-2013-3614
Published: 2013-09-17
Description: Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/800094; http://www.kb.cert.org/vuls/id/800094
CVE: CVE-2013-3615
Published: 2013-09-17
Description: Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/800094; http://www.kb.cert.org/vuls/id/800094
CVE: CVE-2013-5620
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5621
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5622
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5623
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5624
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5625
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5626
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5627
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5628
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5629
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5630
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5631
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5632
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5633
Published: 2013-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA.  Notes: The posting will later have IDs assigned in accordance with CVE content decisions
CVE: CVE-2013-5709
Published: 2013-09-17
Description: The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value.
CVSS Score: 8.3 (HIGH)
CWE: CWE-189
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-254-01; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-850708.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-850708.pdf
CVE: CVE-2013-5754
Published: 2013-09-17
Description: The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/800094; http://www.kb.cert.org/vuls/id/800094
CVE: CVE-2013-1718
Published: 2013-09-18
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html
CVE: CVE-2013-1719
Published: 2013-09-18
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html