deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1015
Published: 2013-05-24
Description: Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TeXML file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16237
CVE: CVE-2013-1016
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.263 encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16497
CVE: CVE-2013-1017
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16606
CVE: CVE-2013-1018
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770
CVE: CVE-2013-1019
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
CVE: CVE-2013-1020
Published: 2013-05-24
Description: Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG data in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16365
CVE: CVE-2013-1021
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG data in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16728
CVE: CVE-2013-1022
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted mvhd atoms in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770
CVE: CVE-2013-3633
Published: 2013-05-24
Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.
CVSS Score: 8.0 (HIGH)
CWE: CWE-264
References: https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf
CVE: CVE-2013-3634
Published: 2013-05-24
Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The implementation of SNMPv3 does not check the user credentials sufficiently. Therefore, an attacker is able to execute SNMP commands without correct credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf
CVE: CVE-2013-3660
Published: 2013-05-24
Description: The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html
CVE: CVE-2013-3661
Published: 2013-05-24
Description: The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html; http://secunia.com/advisories/53435
CVE: CVE-2013-2079
Published: 2013-05-25
Description: mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38443; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
CVE: CVE-2013-2080
Published: 2013-05-25
Description: The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37475; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
CVE: CVE-2013-2081
Published: 2013-05-25
Description: Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
CVE: CVE-2013-2082
Published: 2013-05-25
Description: Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
CVE: CVE-2013-2083
Published: 2013-05-25
Description: The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38885; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
CVE: CVE-2013-3555
Published: 2013-05-25
Description: epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-gtpv2.c?r1=48393&r2=48392&pathrev=48393; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48393; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3556
Published: 2013-05-25
Description: The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/reassemble.c?r1=48943&r2=48942&pathrev=48943; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48943; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3557
Published: 2013-05-25
Description: The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ber.c?r1=48944&r2=48943&pathrev=48944; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48944; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3558
Published: 2013-05-25
Description: The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ppp.c?r1=49214&r2=49213&pathrev=49214; http://anonsvn.wireshark.org/viewvc?view=revision&revision=49214; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3559
Published: 2013-05-25
Description: epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=48644&r2=48643&pathrev=48644; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48644; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3560
Published: 2013-05-25
Description: The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-mpeg-dsmcc.c?r1=48332&r2=48331&pathrev=48332; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48332; http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
CVE: CVE-2013-3561
Published: 2013-05-25
Description: Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-etch.c?r1=48919&r2=48918&pathrev=48919; http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-mysql.c?r1=48894&r2=48893&pathrev=48894; http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-websocket.c?r1=48336&r2=48335&pathrev=48336
CVE: CVE-2013-3562
Published: 2013-05-25
Description: Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk-1.8/epan/dissectors/packet-websocket.c?r1=48419&r2=48418&pathrev=48419; http://anonsvn.wireshark.org/viewvc?view=revision&revision=48419; http://lists.opensuse.org/opensuse-updates/2013-06/msg00194.html
CVE: CVE-2012-6399
Published: 2013-05-27
Description: Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, aka Bug ID CSCud94176.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/51412; http://secunia.com/advisories/51412
CVE: CVE-2013-2953
Published: 2013-05-27
Description: IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-2954
Published: 2013-05-27
Description: The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; https://exchange.xforce.ibmcloud.com/vulnerabilities/83663; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-2955
Published: 2013-05-27
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; https://exchange.xforce.ibmcloud.com/vulnerabilities/83664; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-2956
Published: 2013-05-27
Description: SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; https://exchange.xforce.ibmcloud.com/vulnerabilities/83665; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-2957
Published: 2013-05-27
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; https://exchange.xforce.ibmcloud.com/vulnerabilities/83666; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-2959
Published: 2013-05-27
Description: The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637444; https://exchange.xforce.ibmcloud.com/vulnerabilities/83668; http://www-01.ibm.com/support/docview.wss?uid=swg21637444
CVE: CVE-2013-0576
Published: 2013-05-28
Description: Cross-site scripting (XSS) vulnerability in the Tivoli Enterprise Portal browser client in IBM Tivoli Monitoring 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV32812; http://www-01.ibm.com/support/docview.wss?uid=swg21634920; https://exchange.xforce.ibmcloud.com/vulnerabilities/83328
CVE: CVE-2013-0499
Published: 2013-05-28
Description: Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2013/May/83; http://www-01.ibm.com/support/docview.wss?uid=swg21637717; https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
CVE: CVE-2013-0599
Published: 2013-05-28
Description: IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information associated with the 500 HTTP status code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21637151; http://www.securityfocus.com/bid/60107; https://exchange.xforce.ibmcloud.com/vulnerabilities/83613
CVE: CVE-2013-2989
Published: 2013-05-28
Description: The file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX on AIX 6.1 through 7.1 uses incorrect privileges, which allows local users to bypass filesystem read permissions and write permissions by leveraging authentication to the Connect:Direct product.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC86449; http://www-01.ibm.com/support/docview.wss?uid=swg21637561; https://exchange.xforce.ibmcloud.com/vulnerabilities/84016
CVE: CVE-2013-1962
Published: 2013-05-29
Description: The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.html
CVE: CVE-2013-2069
Published: 2013-05-29
Description: Red Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x before 18.16, and 19.x before 19.3, when a rootpw directive is not set in a Kickstart file, sets the root user password to empty, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0849.html; http://www.openwall.com/lists/oss-security/2013/05/23/2; http://www.securityfocus.com/bid/60119
CVE: CVE-2002-2443
Published: 2013-05-29
Description: schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://krbdev.mit.edu/rt/Ticket/Display.html?id=7637; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105879.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105978.html
CVE: CVE-2013-0482
Published: 2013-05-29
Description: IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC88185; http://www-01.ibm.com/support/docview.wss?uid=swg1PM76582; http://www-01.ibm.com/support/docview.wss?uid=swg1PM86026
CVE: CVE-2013-3666
Published: 2013-05-29
Description: The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging mode, using Android Debug Bridge (adb) to establish a USB connection, dialing 3845#*973#, modifying the WLAN Test Wi-Fi Ping Test/User Command tcpdump command string, and pressing the CANCEL button.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2013/May/166; http://www.youtube.com/watch?v=ZfbDIpTY-t4; https://plus.google.com/[PII_REDACTED][PII_REDACTED]/posts/9KxBtkyuYcj