deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0872
Published: 2013-11-23
Description: The swr_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid or unsupported (1) input or (2) output channel layout, related to an out-of-bounds array access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=21cd905cd44a4bbafe8631bbaa6021d328413ce5; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0873
Published: 2013-11-23
Description: The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=4f1279154ee9baf2078241bf[PII_REDACTED]d18b25; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0874
Published: 2013-11-23
Description: The (1) doubles2str and (2) shorts2str functions in libavcodec/tiff.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via a crafted TIFF image, related to an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=e1219cdaf9fb4bc8cea410e1caf802373c1bfe51; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0875
Published: 2013-11-23
Description: The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=1ac0fa50eff30d413206cffa5f47f7fe6d4849b1; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0876
Published: 2013-11-23
Description: Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via crafted LucasArts Smush data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5260edee7e5bd975837696c8c8c1a80eb2fbd7c1; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0877
Published: 2013-11-23
Description: The old_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted LucasArts Smush data that has a large size when decoded, related to an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=365270aec5c2b9284230abc702b11168818f14cf; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0878
Published: 2013-11-23
Description: The advance_line function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Targa image data, related to an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f5955d9f6f9ffdb81864c3de1c7b801782a55725; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-2029
Published: 2013-11-23
Description: nagios.upgrade_to_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to overwrite arbitrary files via a symlink attack on a temporary nagioscfg file with a predictable name in /tmp/.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2013-1526.html; https://bugzilla.redhat.com/show_bug.cgi?id=958015; http://rhn.redhat.com/errata/RHSA-2013-1526.html
CVE: CVE-2013-4214
Published: 2013-11-23
Description: rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2013-1526.html; http://www.securityfocus.com/bid/61747; https://bugzilla.redhat.com/show_bug.cgi?id=958002
CVE: CVE-2013-4263
Published: 2013-11-23
Description: libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.ffmpeg.org/security.html; http://www.openwall.com/lists/oss-security/2013/08/21/11; https://github.com/FFmpeg/FFmpeg/commit/e43a0a232dbf6d3c161823c2e07c52e76227a1bc
CVE: CVE-2013-4264
Published: 2013-11-23
Description: The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.ffmpeg.org/security.html; http://www.openwall.com/lists/oss-security/2013/08/21/11; https://github.com/FFmpeg/FFmpeg/commit/[PII_REDACTED]d17d71cc8dccc926352ce568b5eec1
CVE: CVE-2013-4265
Published: 2013-11-23
Description: The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.
CVSS Score: 10.0 (HIGH)
References: http://www.ffmpeg.org/security.html; http://www.openwall.com/lists/oss-security/2013/08/21/11; https://github.com/FFmpeg/FFmpeg/commit/c94f9e854228e0ea00e1de8769d8d3f7cab84a55
CVE: CVE-2013-4354
Published: 2013-11-23
Description: The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/09/19/2; http://www.openwall.com/lists/oss-security/2013/09/19/3; https://bugs.launchpad.net/glance/+bug/1226078
CVE: CVE-2013-6858
Published: 2013-11-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html; http://secunia.com/advisories/55770; http://secunia.com/advisories/56117
CVE: CVE-2012-0786
Published: 2013-11-23
Description: The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://augeas.net/news.html; http://rhn.redhat.com/errata/RHSA-2013-1537.html; http://secunia.com/advisories/55811
CVE: CVE-2012-0787
Published: 2013-11-23
Description: The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.
CVSS Score: 3.7 (LOW)
References: http://augeas.net/news.html; http://rhn.redhat.com/errata/RHSA-2013-1537.html; http://secunia.com/advisories/55811
CVE: CVE-2012-6607
Published: 2013-11-23
Description: The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: http://augeas.net/news.html; http://rhn.redhat.com/errata/RHSA-2013-1537.html; http://secunia.com/advisories/55811
CVE: CVE-2013-0221
Published: 2013-11-23
Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-1652.html; https://bugzilla.novell.com/show_bug.cgi?id=798538; https://bugzilla.redhat.com/show_bug.cgi?id=903464
CVE: CVE-2013-0222
Published: 2013-11-23
Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2013-1652.html; https://bugzilla.novell.com/show_bug.cgi?id=796243; https://bugzilla.redhat.com/show_bug.cgi?id=903465
CVE: CVE-2013-0223
Published: 2013-11-23
Description: The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.
CVSS Score: 1.9 (LOW)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2013-1652.html; https://bugzilla.novell.com/show_bug.cgi?id=798541; https://bugzilla.redhat.com/show_bug.cgi?id=903466
CVE: CVE-2013-0860
Published: 2013-11-23
Description: The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3e196e4def03c7a[PII_REDACTED]2f84d638d316c33; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=68a0477bc0af026db971ddba22541029a9e8715b; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0861
Published: 2013-11-23
Description: The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=43c6b45a53a186a187f7266e4d6bd3c2620519f1; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=4cd1dad91ae97fe1f0dd534c3f[PII_REDACTED]f137; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0862
Published: 2013-11-23
Description: Multiple integer overflows in the process_frame_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f4fb841ad13bab66d4fb0c7ff2a94770df7815d8; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0863
Published: 2013-11-23
Description: Buffer overflow in the rle_decode function in libavcodec/sanm.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via crafted LucasArts Smush video data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=62c9beda0c189db5cb61fa772057e3af9521f293; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=89e16e675d3cbe76cf4581f98bf4ac300cab0286; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0864
Published: 2013-11-23
Description: The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspecified impact via crafted GIF data that triggers an out-of-bounds array access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9547034f9120187e23ad76424dd4d70247e62212; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0865
Published: 2013-11-23
Description: The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=08e2c7a45f82b897a285548c257972eb1ad352c5; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f3d16706060ab6ae6dc78f15359fab3fd87c9495; http://www.debian.org/security/2014/dsa-2855
CVE: CVE-2013-0866
Published: 2013-11-23
Description: The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large number of channels in an AAC file, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=47e462eecc0a47ad40f59376199f93f227e21d13; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c459c7b23efffab762560e41ad6a2c0dbbfd4915; http://www.debian.org/security/2013/dsa-2793
CVE: CVE-2013-0867
Published: 2013-11-23
Description: The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which allows remote attackers to have unspecified impact via crafted H.264 video data, related to an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=3ef1538121fa6daeb1767510f1d4ae2c306c9fec; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2013-0868
Published: 2013-11-23
Description: libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6baa54924980e1f0e8121e4715d16ed1adcd2a23; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=75e88db33013eaa7ab74457f5556df677b4ffb42; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0869
Published: 2013-11-23
Description: The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=eaa9d2cd6b8c1e2722d5bfc56ea67fde865200ce; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=eaa9d2cd6b8c1e2722d5bfc56ea67fde865200ce
CVE: CVE-2013-1058
Published: 2013-11-23
Description: maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/55567; http://www.ubuntu.com/usn/USN-2013-1; https://bugs.launchpad.net/maas/%2Bbug/1039513
CVE: CVE-2013-1894
Published: 2013-11-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2561. Reason: This candidate is a duplicate of CVE-2013-2561. Notes: All CVE users should reference CVE-2013-2561 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2561
Published: 2013-11-23
Description: OpenFabrics ibutils 1.5.7 allows local users to overwrite arbitrary files via a symlink attack on (1) ibdiagnet.db, (2) ibdiagnet.fdbs, (3) ibdiagnet_ibis.log, (4) ibdiagnet.log, (5) ibdiagnet.lst, (6) ibdiagnet.mcfdbs, (7) ibdiagnet.pkey, (8) ibdiagnet.psl, (9) ibdiagnet.slvl, or (10) ibdiagnet.sm in /tmp/.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2013-1661.html; http://seclists.org/fulldisclosure/2013/Mar/87; http://www.openwall.com/lists/oss-security/2013/03/19/8
CVE: CVE-2013-4407
Published: 2013-11-23
Description: HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634; http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161; http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=cc75c886256f187cda388641931e8dafad6c2346
CVE: CVE-2013-4459
Published: 2013-11-23
Description: LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.freedesktop.org/archives/lightdm/2013-October/000471.html; http://lists.freedesktop.org/archives/lightdm/2013-October/000472.html; http://www.ubuntu.com/usn/USN-2012-1
CVE: CVE-2013-4547
Published: 2013-11-23
Description: nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.html
CVE: CVE-2013-6384
Published: 2013-11-23
Description: (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
CVSS Score: 1.9 (LOW)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2013/11/22/3; http://www.openwall.com/lists/oss-security/2013/11/25/3; https://bugs.launchpad.net/ceilometer/+bug/1244476
CVE: CVE-2013-6859
Published: 2013-11-23
Description: SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6860
Published: 2013-11-23
Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6861
Published: 2013-11-23
Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6862
Published: 2013-11-23
Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371; http://secunia.com/advisories/55537
CVE: CVE-2013-6863
Published: 2013-11-23
Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6864
Published: 2013-11-23
Description: Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to affect confidentiality, integrity, and availability via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6865
Published: 2013-11-23
Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR732989.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6866
Published: 2013-11-23
Description: SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6867
Published: 2013-11-23
Description: Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.1 (HIGH)
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371
CVE: CVE-2013-6868
Published: 2013-11-23
Description: SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/55537; http://www.sybase.com/detail?id=1099371; http://secunia.com/advisories/55537
CVE: CVE-2013-4164
Published: 2013-11-23
Description: Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00009.html