deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4998
Published: 2013-07-31
Description: phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php
CVE: CVE-2013-4999
Published: 2013-07-31
Description: phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php
CVE: CVE-2013-5000
Published: 2013-07-31
Description: phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php
CVE: CVE-2013-5001
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php; http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php
CVE: CVE-2013-5002
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/59832; http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php; http://www.securityfocus.com/bid/61516
CVE: CVE-2013-5003
Published: 2013-07-31
Description: Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/59832; http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php; http://www.securityfocus.com/bid/61923
CVE: CVE-2013-2881
Published: 2013-07-31
Description: Google Chrome before 28.0.1500.95 does not properly handle frames, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://www.debian.org/security/2013/dsa-2732; https://code.google.com/p/chromium/issues/detail?id=257748
CVE: CVE-2013-2882
Published: 2013-07-31
Description: Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://rhn.redhat.com/errata/RHSA-2013-1201.html; http://www.debian.org/security/2013/dsa-2732
CVE: CVE-2013-2883
Published: 2013-07-31
Description: Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to deleting the registration of a MutationObserver object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://www.debian.org/security/2013/dsa-2732; https://code.google.com/p/chromium/issues/detail?id=260165
CVE: CVE-2013-2884
Published: 2013-07-31
Description: Use-after-free vulnerability in the DOM implementation in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper tracking of which document owns an Attr object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://www.debian.org/security/2013/dsa-2732; https://code.google.com/p/chromium/issues/detail?id=248950
CVE: CVE-2013-2885
Published: 2013-07-31
Description: Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields input type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://www.debian.org/security/2013/dsa-2732; https://chromium.googlesource.com/chromium/blink/+/7a7ea525c912f6e59aa3e915e7f2cf140c077a49
CVE: CVE-2013-2886
Published: 2013-07-31
Description: Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.95 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html; http://www.debian.org/security/2013/dsa-2732; https://code.google.com/p/chromium/issues/detail?id=246203
CVE: CVE-2013-1377
Published: 2013-07-31
Description: Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-20.html; http://www.adobe.com/support/security/bulletins/apsb13-20.html
CVE: CVE-2013-2367
Published: 2013-07-31
Description: Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03861260; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03861260
CVE: CVE-2013-3425
Published: 2013-07-31
Description: The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a file exists, which allows remote authenticated users to enumerate files via a series of SPI calls, aka Bug ID CSCuc35965.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/95876; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3425; https://exchange.xforce.ibmcloud.com/vulnerabilities/86150
CVE: CVE-2013-4697
Published: 2013-07-31
Description: Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and 10-01; and Hitachi IT Operations Director 02-50 through 02-50-07, 03-00 through 03-00-12, and 04-00 through 04-00-01 allow remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://jvn.jp/en/jp/JVN00065218/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000076; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-017/index.html
CVE: CVE-2013-5006
Published: 2013-07-31
Description: main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.06.28, allows remote attackers to discover the cleartext administrative password by reading the "var pass=" line within the HTML source code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0133.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0146.html; http://www.osvdb.org/95519
CVE: CVE-2013-0943
Published: 2013-07-31
Description: EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0193.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0193.html
CVE: CVE-2013-1968
Published: 2013-07-31
Description: Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E
CVE: CVE-2013-2056
Published: 2013-07-31
Description: The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2013-0848.html; http://secunia.com/advisories/53487; http://www.osvdb.org/93566
CVE: CVE-2013-2088
Published: 2013-07-31
Description: contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E
CVE: CVE-2013-2112
Published: 2013-07-31
Description: The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E; http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E
CVE: CVE-2013-2113
Published: 2013-07-31
Description: The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://projects.theforeman.org/issues/2630; http://rhn.redhat.com/errata/RHSA-2013-0995.html; https://bugzilla.redhat.com/show_bug.cgi?id=968166
CVE: CVE-2013-2121
Published: 2013-07-31
Description: Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://projects.theforeman.org/issues/2631; http://rhn.redhat.com/errata/RHSA-2013-0995.html; http://www.exploit-db.com/exploits/27045
CVE: CVE-2013-2174
Published: 2013-07-31
Description: Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://curl.haxx.se/docs/adv_20130622.html; http://lists.opensuse.org/opensuse-updates/2013-07/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-0983.html
CVE: CVE-2013-2189
Published: 2013-07-31
Description: Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://osvdb.org/95704; http://seclists.org/bugtraq/2013/Jul/173; http://www.openoffice.org/security/cves/CVE-2013-2189.html
CVE: CVE-2013-2209
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/06/24/2; http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/; http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/
CVE: CVE-2013-2219
Published: 2013-07-31
Description: The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-1116.html; http://rhn.redhat.com/errata/RHSA-2013-1119.html; https://bugzilla.redhat.com/show_bug.cgi?id=979508
CVE: CVE-2013-2220
Published: 2013-07-31
Description: Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714362; http://pecl.php.net/package/radius/1.2.7; http://www.debian.org/security/2013/dsa-2726
CVE: CVE-2013-2630
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in CA Service Desk Manager 12.5 through 12.7 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B8C50A6C7-8633-45A8-A0A6-3D454437AD53%7D; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B8C50A6C7-8633-45A8-A0A6-3D454437AD53%7D
CVE: CVE-2013-2785
Published: 2013-07-31
Description: Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-170-01; http://support.ge-ip.com/support/index?page=kbchannel&id=KB15602; http://ics-cert.us-cert.gov/advisories/ICSA-13-170-01
CVE: CVE-2013-3697
Published: 2013-07-31
Description: Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003 and the NCPL.SYS kernel driver in Novell Client 2 SP2 on Windows Vista and Windows Server 2008 and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 might allow local users to gain privileges via a crafted 0x1439EB IOCTL call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://pastebin.com/RcS2Bucg; http://www.novell.com/support/kb/doc.php?id=7012497; http://pastebin.com/RcS2Bucg
CVE: CVE-2013-3956
Published: 2013-07-31
Description: The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista and Windows Server 2008; and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted 0x143B6B IOCTL call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://pastebin.com/GB4iiEwR; http://www.exploit-db.com/exploits/26452; http://www.exploit-db.com/exploits/27191
CVE: CVE-2013-4131
Published: 2013-07-31
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00000.html; http://subversion.apache.org/security/CVE-2013-4131-advisory.txt; http://www.securityfocus.com/bid/61454
CVE: CVE-2013-4156
Published: 2013-07-31
Description: Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://osvdb.org/95706; http://seclists.org/bugtraq/2013/Jul/174; http://www.openoffice.org/security/cves/CVE-2013-4156.html
CVE: CVE-2013-4674
Published: 2013-07-31
Description: Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95581; http://secunia.com/advisories/54214; http://www.securityfocus.com/bid/61290
CVE: CVE-2013-5019
Published: 2013-07-31
Description: Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/95164; http://www.exploit-db.com/exploits/26739; http://www.exploit-db.com/exploits/31736
CVE: CVE-2013-5020
Published: 2013-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in bb_admin.php in MiniBB before 3.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_name, (2) forum_group, (3) forum_icon, or (4) forum_desc parameter.  NOTE: the whatus vector is already covered by CVE-2008-2066.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95122; http://seclists.org/fulldisclosure/2013/Jul/102; http://www.minibb.com/download.php?file=minibb_update
CVE: CVE-2013-2993
Published: 2013-08-01
Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, which allows remote attackers to issue requests in the context of an arbitrary user's active session via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR45302; http://www-01.ibm.com/support/docview.wss?uid=swg21644391; https://exchange.xforce.ibmcloud.com/vulnerabilities/84031
CVE: CVE-2013-1616
Published: 2013-08-01
Description: The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html; http://www.securityfocus.com/bid/61106; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00
CVE: CVE-2013-1617
Published: 2013-08-01
Description: Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html; http://www.securityfocus.com/bid/61101; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00
CVE: CVE-2013-4670
Published: 2013-08-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95690; http://osvdb.org/95692; http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html
CVE: CVE-2013-4671
Published: 2013-08-01
Description: Cross-site request forgery (CSRF) vulnerability in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/95699; http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html; http://www.securityfocus.com/bid/61102
CVE: CVE-2013-4672
Published: 2013-08-01
Description: The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/95695; http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html; http://www.securityfocus.com/bid/61104
CVE: CVE-2013-4673
Published: 2013-08-01
Description: The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/95702; http://www.securityfocus.com/bid/61105; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00
CVE: CVE-2013-2994
Published: 2013-08-01
Description: IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420; http://www-01.ibm.com/support/docview.wss?uid=swg21644393; https://exchange.xforce.ibmcloud.com/vulnerabilities/84033