deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4952
Published: 2013-05-01
Description: Henry Schein Dentrix G5 before 15.1.294 has a single internal-database password that is shared across different customers' installations, which allows remote attackers to obtain sensitive information about patients by leveraging knowledge of this password from another installation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.dentrix.com/support/software-updates/g5.aspx; http://www.kb.cert.org/vuls/id/948155; http://www.kb.cert.org/vuls/id/JALR-8ZRHUK
CVE: CVE-2013-0127
Published: 2013-05-01
Description: IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and JMOY95BN49.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2013/Apr/262; http://www-01.ibm.com/support/docview.wss?uid=swg21633819; http://www.kb.cert.org/vuls/id/912420
CVE: CVE-2013-0140
Published: 2013-05-01
Description: SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
CVSS Score: 7.9 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Apr/289; http://www.kb.cert.org/vuls/id/209131; http://www.securityfocus.com/bid/59500
CVE: CVE-2013-0141
Published: 2013-05-01
Description: Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2014/Apr/289; http://www.kb.cert.org/vuls/id/209131; http://www.us-cert.gov/ncas/alerts/TA13-193A
CVE: CVE-2013-0538
Published: 2013-05-01
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21633819; http://www.kb.cert.org/vuls/id/912420; https://exchange.xforce.ibmcloud.com/vulnerabilities/83270
CVE: CVE-2013-0666
Published: 2013-05-01
Description: The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service (unhandled exception and application crash) via a TCP RST packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01
CVE: CVE-2013-0673
Published: 2013-05-01
Description: Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01
CVE: CVE-2013-0699
Published: 2013-05-01
Description: The Galil RIO-47100 Pocket PLC allows remote attackers to cause a denial of service via a session that includes "repeated requests."
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01; http://www.galilmc.com/support/downloads/firmware_rev/firm47xxx.html; http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01
CVE: CVE-2013-1156
Published: 2013-05-01
Description: Directory traversal vulnerability in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCud51034.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1156; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1156
CVE: CVE-2013-1157
Published: 2013-05-01
Description: Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) Java servlet container in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud51068.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1157; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1157
CVE: CVE-2013-1158
Published: 2013-05-01
Description: Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) help menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud54397.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1158; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1158
CVE: CVE-2013-1159
Published: 2013-05-01
Description: Cross-site scripting (XSS) vulnerability in the Netcool Impact (NCI) web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56706.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1159; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1159
CVE: CVE-2013-1160
Published: 2013-05-01
Description: Cross-site scripting (XSS) vulnerability in the OpenView web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56743.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1160; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1160
CVE: CVE-2013-1229
Published: 2013-05-01
Description: TMSSNMPService.exe in TelePresence Manager in Cisco TelePresence Management Suite (TMS) on 64-bit platforms allows remote attackers to cause a denial of service (process crash) via SNMP traps, aka Bug ID CSCue00028.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1229; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1229
CVE: CVE-2013-1230
Published: 2013-05-01
Description: Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP packets, aka Bug ID CSCug47057.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1230; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1230
CVE: CVE-2013-3061
Published: 2013-05-01
Description: The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0176.html; http://scn.sap.com/docs/DOC-8218; http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-healthcare
CVE: CVE-2013-3062
Published: 2013-05-01
Description: The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0178.html; http://scn.sap.com/docs/DOC-8218; http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/38-privilege-escalation-in-sap-production-planning-and-control
CVE: CVE-2013-3063
Published: 2013-05-01
Description: SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0179.html; http://scn.sap.com/docs/DOC-8218; http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/39-remote-code-execution-in-sap-connect-communication-services
CVE: CVE-2013-3079
Published: 2013-05-01
Description: VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface (VAMI) access.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://www.vmware.com/security/advisories/VMSA-2013-0006.html; http://www.vmware.com/security/advisories/VMSA-2013-0006.html
CVE: CVE-2013-3080
Published: 2013-05-01
Description: VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to create or overwrite arbitrary files, and consequently execute arbitrary code or cause a denial of service, by leveraging Virtual Appliance Management Interface (VAMI) web-interface access.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.vmware.com/security/advisories/VMSA-2013-0006.html; http://www.vmware.com/security/advisories/VMSA-2013-0006.html
CVE: CVE-2013-3107
Published: 2013-05-01
Description: VMware vCenter Server 5.1 before Update 1, when anonymous LDAP binding for Active Directory is enabled, allows remote attackers to bypass authentication by providing a valid username in conjunction with an empty password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.vmware.com/security/advisories/VMSA-2013-0006.html; http://www.vmware.com/security/advisories/VMSA-2013-0006.html
CVE: CVE-2012-5222
Published: 2013-05-02
Description: HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748875; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748875
CVE: CVE-2013-1338
Published: 2013-05-02
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1303 and CVE-2013-1304.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-100A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-028; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16621
CVE: CVE-2013-2321
Published: 2013-05-02
Description: Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748875; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748875
CVE: CVE-2009-5135
Published: 2013-05-02
Description: The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://echo.nextapp.com/site/node/5742; http://secunia.com/advisories/34218; http://www.exploit-db.com/exploits/8191/
CVE: CVE-2013-3266
Published: 2013-05-02
Description: The nfsrvd_readdir function in sys/fs/nfsserver/nfs_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify that a READDIR request is for a directory node, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by specifying a plain file instead of a directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/53241; http://www.debian.org/security/2013/dsa-2672; http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc
CVE: CVE-2009-5029
Published: 2013-05-02
Description: Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://dividead.wordpress.com/2009/06/01/glibc-timezone-integer-overflow/; http://lists.grok.org.uk/pipermail/full-disclosure/2011-December/084452.html; http://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=97ac2654b2d831acaa18a2b018b[PII_REDACTED]fd2
CVE: CVE-2011-4609
Published: 2013-05-02
Description: The svc_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) via a large number of RPC connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: https://bugzilla.redhat.com/show_bug.cgi?id=767299; https://bugzilla.redhat.com/show_bug.cgi?id=767299
CVE: CVE-2012-0864
Published: 2013-05-02
Description: Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2012-0393.html; http://rhn.redhat.com/errata/RHSA-2012-0397.html; http://rhn.redhat.com/errata/RHSA-2012-0488.html
CVE: CVE-2012-4481
Published: 2013-05-02
Description: The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects.  NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0129.html; http://rhn.redhat.com/errata/RHSA-2013-0612.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:124
CVE: CVE-2012-5657
Published: 2013-05-02
Description: The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://framework.zend.com/security/advisory/ZF2012-05; http://openwall.com/lists/oss-security/2012/12/20/2; http://openwall.com/lists/oss-security/2012/12/20/4
CVE: CVE-2013-0305
Published: 2013-05-02
Description: The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-0670.html; http://ubuntu.com/usn/usn-1757-1; http://www.debian.org/security/2013/dsa-2634
CVE: CVE-2013-0306
Published: 2013-05-02
Description: The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2013-0670.html; http://ubuntu.com/usn/usn-1757-1; http://www.debian.org/security/2013/dsa-2634
CVE: CVE-2013-1845
Published: 2013-05-02
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E
CVE: CVE-2013-1846
Published: 2013-05-02
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E
CVE: CVE-2013-1847
Published: 2013-05-02
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E
CVE: CVE-2013-1849
Published: 2013-05-02
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E
CVE: CVE-2013-1884
Published: 2013-05-02
Description: The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html; http://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3E; http://subversion.apache.org/security/CVE-2013-1884-advisory.txt
CVE: CVE-2013-2944
Published: 2013-05-02
Description: strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: http://download.strongswan.org/patches/10_openssl_ecdsa_signature_patch/strongswan-4.3.5-5.0.3_openssl_ecdsa_signature.patch; http://lists.opensuse.org/opensuse-updates/2013-05/msg00014.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00010.html
CVE: CVE-2013-0535
Published: 2013-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21635185; http://www-01.ibm.com/support/docview.wss?uid=swg21635545; https://exchange.xforce.ibmcloud.com/vulnerabilities/82657
CVE: CVE-2013-0582
Published: 2013-05-02
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a SAML 2.0 response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV26033; http://www-01.ibm.com/support/docview.wss?uid=swg1IV26034; http://www-01.ibm.com/support/docview.wss?uid=swg1IV31640
CVE: CVE-2013-1091
Published: 2013-05-02
Description: Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=k6yH0sy992E~; http://www.novell.com/support/kb/doc.php?id=7012344; http://www.securityfocus.com/bid/59612
CVE: CVE-2013-0940
Published: 2013-05-03
Description: The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0013.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0013.html
CVE: CVE-2013-0944
Published: 2013-05-03
Description: The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0012.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0012.html
CVE: CVE-2013-0945
Published: 2013-05-03
Description: EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0014.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0014.html
CVE: CVE-2013-1231
Published: 2013-05-03
Description: The HTTP implementation in Cisco WebEx Node for MCS and WebEx Meetings Server allows remote attackers to read cache files via a crafted request, aka Bug IDs CSCue36664 and CSCue36629.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1231; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1231
CVE: CVE-2013-1234
Published: 2013-05-03
Description: The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (process restart) via crafted SNMP packets, aka Bug ID CSCue69472.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1234; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1234