deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5187
Published: 2013-02-06
Description: The Weathernews Touch application 2.3.2 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN86040029/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000005; http://jvn.jp/en/jp/JVN86040029/index.html
CVE: CVE-2013-0254
Published: 2013-02-06
Description: The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00014.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00019.html
CVE: CVE-2013-1107
Published: 2013-02-06
Description: The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1107; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1107
CVE: CVE-2013-1120
Published: 2013-02-06
Description: Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120
CVE: CVE-2013-1463
Published: 2013-02-07
Description: Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this might be the same vulnerability as CVE-2013-1808.  If so, it is likely that CVE-2013-1463 will be REJECTed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/89754; http://packetstormsecurity.com/files/119968/WordPress-WP-Table-Reloaded-Cross-Site-Scripting.html; http://secunia.com/advisories/52027
CVE: CVE-2013-1464
Published: 2013-02-07
Description: Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://insight-labs.org/?p=738; http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html; http://secunia.com/advisories/52083
CVE: CVE-2012-4700
Published: 2013-02-08
Description: Multiple buffer overflows in an ActiveX control in PE3DO32A.ocx in IntegraXor SCADA Server 4.00 build 4250.0 and earlier allow remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdf; http://www.integraxor.com/blog/security-issue-for-activex-enabled-browser-vulnerability-note; http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdf
CVE: CVE-2013-0633
Published: 2013-02-08
Description: Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00007.html
CVE: CVE-2013-0634
Published: 2013-02-08
Description: Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in February 2013.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00007.html
CVE: CVE-2013-1637
Published: 2013-02-08
Description: Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html; http://www.opera.com/docs/changelogs/unified/1213/; http://www.opera.com/support/kb/view/1042/
CVE: CVE-2013-1638
Published: 2013-02-08
Description: Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html; http://www.opera.com/docs/changelogs/unified/1213/; http://www.opera.com/support/kb/view/1043/
CVE: CVE-2013-1639
Published: 2013-02-08
Description: Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html; http://www.opera.com/docs/changelogs/unified/1213/; http://www.opera.com/support/kb/view/1045/
CVE: CVE-2012-2686
Published: 2013-02-08
Description: crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=125093b59f3c2a2d33785b5563d929d0472f1721; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2053&w=2
CVE: CVE-2013-0166
Published: 2013-02-08
Description: OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7; http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=66e8211c0b[PII_REDACTED]e04b18aa52567c325200; http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ebc71865f0506a293242bd4aec97cdc7a8ef24b0
CVE: CVE-2013-0169
Published: 2013-02-08
Description: The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
CVSS Score: 2.6 (LOW)
CWE: CWE-310
References: http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html
CVE: CVE-2013-1618
Published: 2013-02-08
Description: The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html; http://openwall.com/lists/oss-security/2013/02/05/24; http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
CVE: CVE-2013-1619
Published: 2013-02-08
Description: The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html
CVE: CVE-2013-1620
Published: 2013-02-08
Description: The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html
CVE: CVE-2013-1621
Published: 2013-02-08
Description: Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2013/02/05/24; http://www.debian.org/security/2013/dsa-2622; http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
CVE: CVE-2013-1622
Published: 2013-02-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate is not a security issue.  Further investigation showed that, because of RFC noncompliance, no version or configuration of the product had the vulnerability previously associated with this ID. Notes: none
CVE: CVE-2013-1623
Published: 2013-02-08
Description: The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://openwall.com/lists/oss-security/2013/02/05/24; http://secunia.com/advisories/53372; http://security.gentoo.org/glsa/glsa-201308-06.xml
CVE: CVE-2013-1624
Published: 2013-02-08
Description: The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://openwall.com/lists/oss-security/2013/02/05/24; http://rhn.redhat.com/errata/RHSA-2014-0371.html; http://rhn.redhat.com/errata/RHSA-2014-0372.html
CVE: CVE-2013-0170
Published: 2013-02-08
Description: Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=46532e3e8ed5f5a736a02f67d6c805492f9ca720; http://libvirt.org/news.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098326.html
CVE: CVE-2013-0189
Published: 2013-02-08
Description: cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request.  NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743; http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744; http://lists.fedoraproject.org/pipermail/scm-commits/2013-January/934637.html
CVE: CVE-2013-0242
Published: 2013-02-08
Description: Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/89747; http://rhn.redhat.com/errata/RHSA-2013-0769.html; http://rhn.redhat.com/errata/RHSA-2013-1605.html
CVE: CVE-2013-0262
Published: 2013-02-08
Description: rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html; http://rack.github.com/; http://secunia.com/advisories/52033
CVE: CVE-2013-0263
Published: 2013-02-08
Description: Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html; http://rack.github.com/; http://rhn.redhat.com/errata/RHSA-2013-0686.html
CVE: CVE-2013-1465
Published: 2013-02-08
Description: The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0032.html; http://forums.cubecart.com/?showtopic=47026; http://karmainsecurity.com/KIS-2013-02
CVE: CVE-2012-5189
Published: 2013-02-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-6126
Published: 2013-02-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-4525, CVE-2012-4526.  Reason: This candidate is a duplicate of CVE-2012-4525 and CVE-2012-4526.  Notes: All CVE users should reference CVE-2012-4525 and/or CVE-2012-4526 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1406
Published: 2013-02-11
Description: The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.vmware.com/security/advisories/VMSA-2013-0002.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164; http://www.vmware.com/security/advisories/VMSA-2013-0002.html
CVE: CVE-2011-5256
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in the tooltips in LimeSurvey before 1.91+ Build 1[PII_REDACTED]6, when viewing survey results, allows remote attackers to inject arbitrary web script or HTML via unknown parameters.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://limesurvey.svn.sourceforge.net/viewvc/limesurvey/source/limesurvey/docs/release_notes.txt?view=markup; http://secunia.com/advisories/46831; http://limesurvey.svn.sourceforge.net/viewvc/limesurvey/source/limesurvey/docs/release_notes.txt?view=markup
CVE: CVE-2011-5257
Published: 2013-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.appthemes.com/classipress/classipress-version-3-1-5/; http://secunia.com/advisories/46658; http://www.exploit-db.com/exploits/18053
CVE: CVE-2011-5258
Published: 2013-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/; http://osvdb.org/show/osvdb/77416; http://osvdb.org/show/osvdb/77417
CVE: CVE-2011-5259
Published: 2013-02-12
Description: SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/; http://osvdb.org/show/osvdb/77418; http://secunia.com/advisories/47014
CVE: CVE-2011-5260
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=337; http://www.sdn.sap.com/irj/scn/index?rid=/webcontent/uuid/50316177-762d-2f10-0993-a2206cc349b4; http://www.securityfocus.com/archive/1/520555/100/0/threaded
CVE: CVE-2011-5261
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in serverreport.cgi in Axis M10 Series Network Cameras M1054 firmware 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the pageTitle parameter to admin/showReport.shtml.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://metzgersecurity.blogspot.com/2011/11/xss-vulnerability-axis-m10-series.html; http://osvdb.org/77395; http://secunia.com/advisories/47037
CVE: CVE-2011-5262
Published: 2013-02-12
Description: SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18122; http://www.osvdb.org/77484; http://www.securityfocus.com/bid/50702
CVE: CVE-2011-5263
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=330; http://secunia.com/advisories/45708; http://www.sdn.sap.com/irj/scn/index?rid=/webcontent/uuid/50316177-762d-2f10-0993-a2206cc349b4
CVE: CVE-2011-5264
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?reponame=&new=470737%40lazyest-backup&old=468541%40lazyest-backup; http://secunia.com/advisories/47092; http://wordpress.org/extend/plugins/lazyest-backup/changelog/
CVE: CVE-2011-5265
Published: 2013-02-12
Description: Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.  NOTE: this has been disputed by a third party.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0120.html; http://osvdb.org/77337; http://www.securityfocus.com/archive/1/520625/100/0/threaded
CVE: CVE-2013-0637
Published: 2013-02-12
Description: Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00011.html
CVE: CVE-2013-0638
Published: 2013-02-12
Description: Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0647.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00011.html