deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4509
Published: 2013-11-23
Description: The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html
CVE: CVE-2013-6869
Published: 2013-11-23
Description: SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/55736; http://www.securitytracker.com/id/1029352
CVE: CVE-2013-4041
Published: 2013-11-24
Description: Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://rhn.redhat.com/errata/RHSA-2013-1508.html
CVE: CVE-2013-5375
Published: 2013-11-24
Description: Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://rhn.redhat.com/errata/RHSA-2013-1508.html
CVE: CVE-2013-5456
Published: 2013-11-24
Description: The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://secunia.com/advisories/56338
CVE: CVE-2013-5457
Published: 2013-11-24
Description: Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://rhn.redhat.com/errata/RHSA-2013-1508.html
CVE: CVE-2013-5458
Published: 2013-11-24
Description: Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html; http://rhn.redhat.com/errata/RHSA-2013-1507.html; http://secunia.com/advisories/56338
CVE: CVE-2013-6379
Published: 2013-11-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-4513.  Reason: This candidate is a duplicate of CVE-2013-4513.  Notes: All CVE users should reference CVE-2013-4513 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-6608
Published: 2013-11-25
Description: Cross-site scripting (XSS) vulnerability in xmlservices/E_book.php in Elastix 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the Page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/118454/Elastix-2.3.0-Cross-Site-Scripting.html; http://secunia.com/advisories/55739; http://packetstormsecurity.com/files/118454/Elastix-2.3.0-Cross-Site-Scripting.html
CVE: CVE-2013-3922
Published: 2013-11-25
Description: Directory traversal vulnerability in Gummy Bear Studios FTP Drive + HTTP Server 1.0.4 and earlier allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89161; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-032.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/89161
CVE: CVE-2013-4573
Published: 2013-11-25
Description: Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html; http://secunia.com/advisories/55754; https://bugzilla.wikimedia.org/show_bug.cgi?id=55991
CVE: CVE-2013-6373
Published: 2013-11-25
Description: The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20; https://wiki.jenkins-ci.org/display/JENKINS/Exclusion-Plugin
CVE: CVE-2013-6374
Published: 2013-11-25
Description: Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/100106; http://secunia.com/advisories/55783; https://wiki.jenkins-ci.org/display/JENKINS/Build+Failure+Analyzer
CVE: CVE-2013-6870
Published: 2013-11-25
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55774; http://www.securitytracker.com/id/1029385; http://www.splunk.com/view/SP-CAAAJCD
CVE: CVE-2013-4522
Published: 2013-11-26
Description: lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38743; http://openwall.com/lists/oss-security/2013/11/25/1; https://moodle.org/mod/forum/discuss.php?d=244479
CVE: CVE-2013-4523
Published: 2013-11-26
Description: Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41941; http://openwall.com/lists/oss-security/2013/11/25/1; https://moodle.org/mod/forum/discuss.php?d=244480
CVE: CVE-2013-4524
Published: 2013-11-26
Description: Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41807; http://openwall.com/lists/oss-security/2013/11/25/1; https://moodle.org/mod/forum/discuss.php?d=244481
CVE: CVE-2013-4525
Published: 2013-11-26
Description: Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41820; http://openwall.com/lists/oss-security/2013/11/25/1; https://moodle.org/mod/forum/discuss.php?d=244482
CVE: CVE-2013-3923
Published: 2013-11-26
Description: Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89172; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-034.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/89172
CVE: CVE-2013-6873
Published: 2013-11-26
Description: SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arbitrary SQL commands via the test_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/99992; http://packetstormsecurity.com/files/124035/testa-sql.txt; http://secunia.com/advisories/55752
CVE: CVE-2013-6874
Published: 2013-11-26
Description: Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/29777; http://www.securityfocus.com/bid/63895; http://www.exploit-db.com/exploits/29777
CVE: CVE-2013-6875
Published: 2013-11-26
Description: SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://assets.nagios.com/downloads/nagiosxi/CHANGES-2012.TXT; http://secunia.com/advisories/55695; http://www.security-assessment.com/files/documents/advisory/NagiosQL%20Core%20Config%20Manager%20SQL%20Injection%20Vulnerability%20Advisory%20-%20DA.pdf
CVE: CVE-2013-3394
Published: 2013-11-27
Description: Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted field, aka Bug ID CSCuh41429.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3394; http://tools.cisco.com/security/center/viewAlert.x?alertId=31921; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3394
CVE: CVE-2013-4036
Published: 2013-11-27
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 FP13, and IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP7 and 11.0 before FP2, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21656857; https://exchange.xforce.ibmcloud.com/vulnerabilities/81482; http://www-01.ibm.com/support/docview.wss?uid=swg21656857
CVE: CVE-2013-6378
Published: 2013-11-27
Description: The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a497e47d4aec37aaf8f13509f3ef3d1f6a717d88; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3043.html
CVE: CVE-2013-6380
Published: 2013-11-27
Description: The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4789b8e6be3151a955ade74872822f30e8cd914; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
CVE: CVE-2013-6381
Published: 2013-11-27
Description: Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6fb392b1a63ae36c31f62bc3fc8630b49d602b62; http://rhn.redhat.com/errata/RHSA-2014-0159.html; http://rhn.redhat.com/errata/RHSA-2014-0284.html
CVE: CVE-2013-6382
Published: 2013-11-27
Description: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2013/11/22/5; http://www.securityfocus.com/bid/63889; http://www.spinics.net/lists/xfs/msg23343.html
CVE: CVE-2013-6383
Published: 2013-11-27
Description: The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f856567b930dfcdbc3323261bf77240ccdde01f5; http://rhn.redhat.com/errata/RHSA-2014-0100.html; http://rhn.redhat.com/errata/RHSA-2014-0285.html
CVE: CVE-2013-3920
Published: 2013-11-27
Description: Cross-site scripting (XSS) vulnerability in Jahia xCM before 6.6.2 allows remote authenticated users to inject arbitrary web script or HTML via the "about me" field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-jahia-cve-2013-3920-cve-2013-4617.html; https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-jahia-cve-2013-3920-cve-2013-4617.html
CVE: CVE-2013-4617
Published: 2013-11-27
Description: Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-jahia-cve-2013-3920-cve-2013-4617.html; https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-jahia-cve-2013-3920-cve-2013-4617.html
CVE: CVE-2013-4624
Published: 2013-11-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp, (2) the searchString parameter to administration/ in a search action, or the (3) username, (4) firstName, (5) lastName, (6) email, or (7) organization field to administration/ in a users action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB23159; https://www.htbridge.com/advisory/HTB23159
CVE: CVE-2013-5957
Published: 2013-11-27
Description: Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability; https://github.com/civicrm/civicrm-core/pull/1708.diff; https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html
CVE: CVE-2013-5065
Published: 2013-11-28
Description: NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVSS Score: 7.8 (HIGH)
References: http://technet.microsoft.com/security/advisory/2914486; http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002
CVE: CVE-2013-5912
Published: 2013-11-28
Description: VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/893462; http://www.kb.cert.org/vuls/id/893462
CVE: CVE-2013-6322
Published: 2013-11-28
Description: Cross-site scripting (XSS) vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745; http://www-01.ibm.com/support/docview.wss?uid=swg21656906; https://exchange.xforce.ibmcloud.com/vulnerabilities/88902
CVE: CVE-2013-6712
Published: 2013-11-28
Description: The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=12fe4e90be7bfa2a763197079f68f5568a14e071; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
CVE: CVE-2013-4844
Published: 2013-11-29
Description: Unspecified vulnerability in HP Service Manager 7.11, 9.21, 9.30, 9.31, and 9.32, and ServiceCenter 6.2.8, allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04026812; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04026812
CVE: CVE-2013-6700
Published: 2013-11-29
Description: The SNMP module in Cisco IOS XR allows remote attackers to cause a denial of service (process reload) via a request for an unspecified MIB, aka Bug ID CSCuh43144.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6700; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6700
CVE: CVE-2013-6706
Published: 2013-11-29
Description: The Cisco Express Forwarding processing module in Cisco IOS XE allows remote attackers to cause a denial of service (device reload) via crafted MPLS packets that are not properly handled during IP header validation, aka Bug ID CSCuj23992.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/100394; http://secunia.com/advisories/55817; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6706
CVE: CVE-2013-6885
Published: 2013-11-29
Description: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://lists.dragonflybsd.org/pipermail/kernel/2011-December/046594.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123553.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124195.html
CVE: CVE-2013-5448
Published: 2013-11-29
Description: Cross-site scripting (XSS) vulnerability in the Right Click Plugin context menus in IBM Security QRadar SIEM 7.1 and 7.2 before 7.2 MR1 Patch 1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21656875; http://www.securityfocus.com/bid/63938; https://exchange.xforce.ibmcloud.com/vulnerabilities/87912
CVE: CVE-2013-5463
Published: 2013-11-29
Description: The WinCollect agent in IBM Security QRadar SIEM before 7.1.1.569824 allows remote attackers to bypass intended access restrictions by injecting a (1) DLL or (2) configuration file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21656875; https://exchange.xforce.ibmcloud.com/vulnerabilities/88361; http://www-01.ibm.com/support/docview.wss?uid=swg21656875
CVE: CVE-2013-6307
Published: 2013-11-29
Description: Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21656875; http://www.securityfocus.com/bid/63939; https://exchange.xforce.ibmcloud.com/vulnerabilities/88556
CVE: CVE-2013-6791
Published: 2013-11-29
Description: Microsoft Enhanced Mitigation Experience Toolkit (EMET) before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat the ASLR protection mechanism via a return-oriented programming (ROP) attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://blogs.technet.com/b/srd/archive/2013/06/17/emet-4-0-now-available-for-download.aspx; http://en.nsfocus.com/advisories/1301.html; http://www.securitytracker.com/id/1029411
CVE: CVE-2013-6392
Published: 2013-11-30
Description: The genlock_dev_ioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted GENLOCK_IOC_EXPORT ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://openwall.com/lists/oss-security/2013/11/25/4; https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/drivers/base/genlock.c?id=e3c43027bdb59f03eec7ead0a01c77e4bf801625&h=jb_3.2.3; http://openwall.com/lists/oss-security/2013/11/25/4