deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6881
Published: 2014-01-07
Description: CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Dec/80; http://secunia.com/advisories/55989
CVE: CVE-2013-6884
Published: 2014-01-07
Description: The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2013/Dec/80; http://secunia.com/advisories/55989
CVE: CVE-2013-6888
Published: 2014-01-07
Description: Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
CVSS Score: 7.5 (HIGH)
References: http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=02c6850d973e3e1246fde72edab27f03d63acc52; http://marc.info/?l=oss-security&m=[PII_REDACTED]1271&w=2; http://secunia.com/advisories/56192
CVE: CVE-2013-4969
Published: 2014-01-07
Description: Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
CVSS Score: 2.1 (LOW)
CWE: CWE-59
References: http://puppetlabs.com/security/cve/cve-2013-4969; http://secunia.com/advisories/56253; http://secunia.com/advisories/56254
CVE: CVE-2013-6419
Published: 2014-01-07
Description: Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-0091.html; http://rhn.redhat.com/errata/RHSA-2014-0231.html; http://www.openwall.com/lists/oss-security/2013/12/11/8
CVE: CVE-2013-6480
Published: 2014-01-07
Description: Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://libcloud.apache.org/security.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html; http://www.securityfocus.com/archive/1/530624/100/0/threaded
CVE: CVE-2011-1166
Published: 2014-01-07
Description: Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100145416; http://rhn.redhat.com/errata/RHSA-2011-0833.html; http://wiki.xen.org/wiki/Security_Announcements#XSA-1_Host_crash_due_to_failure_to_correctly_validate_PV_kernel_execution_state.
CVE: CVE-2011-1763
Published: 2014-01-07
Description: The get_free_port function in Xen allows local authenticated DomU users to cause a denial of service or possibly gain privileges via unspecified vectors involving a new event channel port.
CVSS Score: 7.7 (HIGH)
References: http://downloads.avaya.com/css/P8/documents/100145416; http://rhn.redhat.com/errata/RHSA-2011-0833.html; https://bugzilla.redhat.com/show_bug.cgi?id=701240
CVE: CVE-2011-1780
Published: 2014-01-07
Description: The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replacing the instruction that causes the VM to exit in one thread with a different instruction in a different thread.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2011-1065.html; http://rhn.redhat.com/errata/RHSA-2011-1163.html; http://www.openwall.com/lists/oss-security/2011/07/07/3
CVE: CVE-2011-1936
Published: 2014-01-07
Description: Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation when exiting the VM, which allows local guest users to cause a denial of service (guest crash) via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2011-0927.html; http://www.openwall.com/lists/oss-security/2011/07/07/3; http://rhn.redhat.com/errata/RHSA-2011-0927.html
CVE: CVE-2013-6436
Published: 2014-01-07
Description: The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=f8c1cb90213508c4f32549023b0572ed774e48aa; http://lists.opensuse.org/opensuse-updates/2014-01/msg00004.html; http://osvdb.org/101485
CVE: CVE-2013-7097
Published: 2014-01-08
Description: Directory traversal vulnerability in 7 Media Web Solutions eduTrac before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the showmask parameter to installer/overview.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/64255; https://www.htbridge.com/advisory/HTB23190; http://www.securityfocus.com/bid/64255
CVE: CVE-2013-7274
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitrary web script or HTML via the title field in a wallpaper file upload.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/56205; http://www.exploit-db.com/exploits/30356; http://www.securityfocus.com/bid/64480
CVE: CVE-2013-7275
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release; http://osvdb.org/101545; http://secunia.com/advisories/55945
CVE: CVE-2013-7276
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the current_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101487; http://packetstormsecurity.com/files/124587/WordPress-Recommend-Cross-Site-Scripting.html; http://secunia.com/advisories/56209
CVE: CVE-2013-7277
Published: 2014-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to saa.php, (2) username parameter to login.php, or (3) keyword_list parameter to keysearch.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.html; http://osvdb.org/101467; http://osvdb.org/101491
CVE: CVE-2013-7278
Published: 2014-01-08
Description: SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to default.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/124624; http://www.securityfocus.com/bid/64572; https://exchange.xforce.ibmcloud.com/vulnerabilities/89988
CVE: CVE-2013-7279
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?old_path=%2Fs3-video&old=823847&new_path=%2Fs3-video&new=823847; http://secunia.com/advisories/56167; http://wordpress.org/plugins/s3-video/changelog
CVE: CVE-2013-7280
Published: 2014-01-08
Description: Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of service (crash) via a long string in a .m3u file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/90816; http://packetstormsecurity.com/files/120611/Hanso-Player-2.1.0-Buffer-Overflow.html; http://www.exploit-db.com/exploits/24556
CVE: CVE-2014-0620
Published: 2014-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/30668; http://www.securityfocus.com/bid/64672; http://www.exploit-db.com/exploits/30668
CVE: CVE-2014-0621
Published: 2014-01-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/30667; http://www.exploit-db.com/exploits/30667
CVE: CVE-2014-1232
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56261; http://wordpress.org/plugins/foliopress-wysiwyg/changelog; http://www.securityfocus.com/bid/64666
CVE: CVE-2013-7281
Published: 2014-01-08
Description: The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bceaa90240b6019ed73b49965eac7d167610be69; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.4; http://www.openwall.com/lists/oss-security/2013/11/28/13
CVE: CVE-2013-6982
Published: 2014-01-08
Description: The BGP implementation in Cisco NX-OS 6.2(2a) and earlier does not properly handle the interaction of UPDATE messages with IPv6, VPNv4, and VPNv6 labeled unicast-address families, which allows remote attackers to cause a denial of service (peer reset) via a crafted message, aka Bug ID CSCuj03174.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101713; http://secunia.com/advisories/56169; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6982
CVE: CVE-2014-0651
Published: 2014-01-08
Description: The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/101809; http://secunia.com/advisories/56365; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0651
CVE: CVE-2014-0652
Published: 2014-01-08
Description: Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101803; http://secunia.com/advisories/56365; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0652
CVE: CVE-2014-0653
Published: 2014-01-08
Description: The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101834; http://secunia.com/advisories/56366; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0653
CVE: CVE-2014-0654
Published: 2014-01-08
Description: Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101802; http://secunia.com/advisories/56365; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0654
CVE: CVE-2014-0655
Published: 2014-01-08
Description: The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101838; http://secunia.com/advisories/56366; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655
CVE: CVE-2014-0656
Published: 2014-01-08
Description: Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101801; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0656; http://www.securityfocus.com/bid/64701
CVE: CVE-2014-0657
Published: 2014-01-08
Description: The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/101800; http://secunia.com/advisories/56368; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657
CVE: CVE-2013-5349
Published: 2014-01-09
Description: Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a crafted JPEG tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a large JPEG tag value and a small size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/55555; http://secunia.com/secunia_research/2013-14/; http://www.securitytracker.com/id/1029527
CVE: CVE-2013-5357
Published: 2014-01-09
Description: Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a long TIFF tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a long TIFF StripByteCounts tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/55555; http://secunia.com/secunia_research/2013-14/; http://www.securitytracker.com/id/1029527
CVE: CVE-2013-5358
Published: 2014-01-09
Description: Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/55555; http://secunia.com/secunia_research/2013-14/; http://www.securitytracker.com/id/1029527
CVE: CVE-2013-5359
Published: 2014-01-09
Description: Stack-based buffer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 might allow remote attackers to execute arbitrary code via a crafted RAW file, as demonstrated using a KDC file with a certain size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/55555; http://secunia.com/secunia_research/2013-14/; http://www.securitytracker.com/id/1029527
CVE: CVE-2013-6997
Published: 2014-01-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf; http://www.osvdb.org/101714; http://www.osvdb.org/101715
CVE: CVE-2013-4353
Published: 2014-01-09
Description: The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://git.openssl.org/gitweb/?p=openssl.git%3Ba=blob_plain%3Bf=CHANGES%3Bhb=refs/heads/OpenSSL_1_0_1-stable; http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=197e0ea817ad64820789d86711d55ff50d71f631; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
CVE: CVE-2013-6955
Published: 2014-01-09
Description: webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/615910; http://www.kb.cert.org/vuls/id/615910
CVE: CVE-2013-7174
Published: 2014-01-09
Description: Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/487078; http://www.securityfocus.com/bid/64719; http://www.securitytracker.com/id/1029577
CVE: CVE-2014-0752
Published: 2014-01-09
Description: The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-529, CWE-264
References: http://www.integraxor.com/blog/category/security/vulnerability-note/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-008-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01
CVE: CVE-2013-7283
Published: 2014-01-09
Description: Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://secunia.com/advisories/56276; http://www.osvdb.org/101575; https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55
CVE: CVE-2013-6462
Published: 2014-01-09
Description: Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=4d024ac10f964f6bd372ae0dd14f02772a6e5f63; http://lists.opensuse.org/opensuse-updates/2014-01/msg00050.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00052.html
CVE: CVE-2013-6923
Published: 2014-01-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname parameter to admin/access_control_user_edit.php or (2) workname parameter to admin/network_workgroup_domain.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124685; http://www.exploit-db.com/exploits/30727; https://exchange.xforce.ibmcloud.com/vulnerabilities/90111
CVE: CVE-2013-7138
Published: 2014-01-09
Description: Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/64717; https://www.htbridge.com/advisory/HTB23191; http://www.securityfocus.com/bid/64717
CVE: CVE-2013-7139
Published: 2014-01-09
Description: SQL injection vulnerability in download.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/64715; https://www.htbridge.com/advisory/HTB23191; http://www.securityfocus.com/bid/64715
CVE: CVE-2013-6321
Published: 2014-01-10
Description: SQL injection vulnerability in IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0.2, and Global Retention Policy and Schedule Management 6.0.1.5 and earlier and 6.0.2 in IBM Atlas Suite (aka Atlas Policy Suite) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101856; http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_sql_injection_vulnerability_cve_2013_6321_and_access_control_vulnerability_cve_2013_6334; http://www.securityfocus.com/bid/64749
CVE: CVE-2013-6334
Published: 2014-01-10
Description: IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0.2, and Global Retention Policy and Schedule Management 6.0.1.5 and earlier and 6.0.2 in IBM Atlas Suite (aka Atlas Policy Suite) do not properly validate sessions, which allows remote attackers to bypass intended access restrictions, and visit PolicyAtlas/ResponseDraftServlet (aka the Compliance Questionnaire Save Draft servlet), via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/show/osvdb/101855; http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_sql_injection_vulnerability_cve_2013_6321_and_access_control_vulnerability_cve_2013_6334; http://www.securityfocus.com/bid/64751
CVE: CVE-2013-6974
Published: 2014-01-10
Description: Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud89431.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101894; http://secunia.com/advisories/56353; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6974