deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5604
Published: 2013-10-30
Description: The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5543
Published: 2013-10-31
Description: Cisco IOS XE 3.4 before 3.4.2S and 3.5 before 3.5.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via malformed ICMP error packets associated with a (1) TCP or (2) UDP session that is under inspection by the Zone-Based Firewall (ZBFW) component, aka Bug ID CSCtt26470.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000
CVE: CVE-2013-5545
Published: 2013-10-31
Description: The PPTP ALG implementation in Cisco IOS XE 3.9 before 3.9.2S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) by sending many PPTP packets over NAT, aka Bug ID CSCuh19936.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000
CVE: CVE-2013-5546
Published: 2013-10-31
Description: The TCP reassembly feature in Cisco IOS XE 3.7 before 3.7.3S and 3.8 before 3.8.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via large TCP packets that are processed by the (1) NAT or (2) ALG component, aka Bug ID CSCud72509.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000
CVE: CVE-2013-5547
Published: 2013-10-31
Description: Cisco IOS XE 3.9 before 3.9.2S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) by sending malformed EoGRE packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCuf08269.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131030-asr1000
CVE: CVE-2013-3630
Published: 2013-11-01
Description: Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html; https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one; https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
CVE: CVE-2013-4484
Published: 2013-11-01
Description: Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0158.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00029.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00033.html
CVE: CVE-2013-4713
Published: 2013-11-01
Description: Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN74608669/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000096; http://www.ioplaza.jp/shop/contents/rdiskmanual.aspx
CVE: CVE-2013-5431
Published: 2013-11-01
Description: Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.1.1 before IF 15, 6.2.0 before IF 14, 6.2.1, and 6.2.2 before IF 8 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1 before IF 15, 6.2.0 before IF 14, 6.2.1, and 6.2.2 before IF 8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV50639; http://www-01.ibm.com/support/docview.wss?uid=swg21654114; http://www.kb.cert.org/vuls/id/596990
CVE: CVE-2013-5548
Published: 2013-11-01
Description: The IKEv2 implementation in Cisco IOS, when AES-GCM or AES-GMAC is used, allows remote attackers to bypass certain IPsec anti-replay features via IPsec tunnel traffic, aka Bug ID CSCuj47795.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5548; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5548
CVE: CVE-2013-5551
Published: 2013-11-01
Description: Cisco Adaptive Security Appliance (ASA) Software, when certain same-security-traffic and management-access options are enabled, allows remote authenticated users to cause a denial of service (stack overflow and device reload) by using the clientless SSL VPN portal for internal-resource browsing, aka Bug ID CSCui51199.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5551; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5551
CVE: CVE-2013-5555
Published: 2013-11-01
Description: Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to cause a denial of service (service restart) via a crafted SIP message, aka Bug ID CSCub54349.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5555; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5555
CVE: CVE-2013-2701
Published: 2013-11-01
Description: Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52951; http://www.securityfocus.com/bid/63198; http://secunia.com/advisories/52951
CVE: CVE-2013-4447
Published: 2013-11-01
Description: Cross-site scripting (XSS) vulnerability in the API in the Simplenews module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/98628; http://packetstormsecurity.com/files/123660/Drupal-Simplenews-6.x-7.x-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2013/Oct/120
CVE: CVE-2013-5977
Published: 2013-11-01
Description: Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html; http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html; http://osvdb.org/98352
CVE: CVE-2013-2652
Published: 2013-11-02
Description: CRLF injection vulnerability in help/help_language.php in WebCollab 3.30 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the item parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0117.html; http://osvdb.org/98768; http://packetstormsecurity.com/files/123771/WebCollab-3.30-HTTP-Response-Splitting.html
CVE: CVE-2013-4401
Published: 2013-11-02
Description: The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML.  NOTE: some of these details are obtained from third party information.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c; http://secunia.com/advisories/55210; http://secunia.com/advisories/60895
CVE: CVE-2013-4457
Published: 2013-11-02
Description: The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://osvdb.org/98835; http://secunia.com/advisories/55365; http://www.openwall.com/lists/oss-security/2013/10/22/10
CVE: CVE-2013-4469
Published: 2013-11-02
Description: OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2013/10/31/3; http://www.ubuntu.com/usn/USN-2247-1; https://bugs.launchpad.net/nova/+bug/1206081
CVE: CVE-2013-4494
Published: 2013-11-02
Description: Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-6075
Published: 2013-11-02
Description: The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://download.strongswan.org/security/CVE-2013-6075/strongswan-4.3.3-5.1.0_id_dn_match.patch; http://www.debian.org/security/2012/dsa-2789; http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html
CVE: CVE-2013-6076
Published: 2013-11-02
Description: strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html; http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html
CVE: CVE-2013-1084
Published: 2013-11-02
Description: Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/55450; http://www.novell.com/support/kb/doc.php?id=7012027; http://www.novell.com/support/kb/doc.php?id=7012760
CVE: CVE-2013-2065
Published: 2013-11-02
Description: (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
CVE: CVE-2013-3285
Published: 2013-11-02
Description: The NetWorker Management Console (NMC) in EMC NetWorker 8.0.x before 8.0.2.3, when using Active Directory/LDAP for authentication, allows remote authenticated users to discover cleartext administrator passwords via (1) unspecified NMC audit reports or (2) requests to RAP resources.
CVSS Score: 3.5 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0150.html; http://osvdb.org/99067; http://www.securityfocus.com/bid/63402
CVE: CVE-2013-3287
Published: 2013-11-02
Description: EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDAP bind password by reading the console.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0155.html; http://www.securityfocus.com/bid/63425; http://archives.neohapsis.com/archives/bugtraq/2013-10/0155.html
CVE: CVE-2013-3617
Published: 2013-11-02
Description: The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/533894; http://www.securityfocus.com/bid/63431; https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
CVE: CVE-2013-3631
Published: 2013-11-02
Description: NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature.  NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/326830; https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats; http://www.kb.cert.org/vuls/id/326830
CVE: CVE-2013-4282
Published: 2013-11-02
Description: Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://cgit.freedesktop.org/spice/spice/commit/?id=8af619009660b24e0b41ad26b30289eea288fcc2; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00008.html; http://rhn.redhat.com/errata/RHSA-2013-1460.html
CVE: CVE-2013-4349
Published: 2013-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-4540.  Reason: This candidate was MERGED into CVE-2012-4540, since it was later discovered that it affected an additional version, but it does not constitute a regression error.  Notes: All CVE users should reference CVE-2012-4540 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4416
Published: 2013-11-02
Description: The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html; http://osvdb.org/99072
CVE: CVE-2013-4477
Published: 2013-11-02
Description: The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0113.html; http://www.openwall.com/lists/oss-security/2013/10/30/6; http://www.ubuntu.com/usn/USN-2034-1
CVE: CVE-2013-6344
Published: 2013-11-02
Description: The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows attackers to conduct cross-frame scripting attacks via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/kb/doc.php?id=7012027; http://www.novell.com/support/kb/doc.php?id=7012027
CVE: CVE-2013-6345
Published: 2013-11-02
Description: Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vectors related to an "Application Exception."
CVSS Score: 10.0 (HIGH)
References: http://www.novell.com/support/kb/doc.php?id=7012027; http://www.novell.com/support/kb/doc.php?id=7012027
CVE: CVE-2013-6346
Published: 2013-11-02
Description: Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.novell.com/support/kb/doc.php?id=7012027; http://www.novell.com/support/kb/doc.php?id=7012027
CVE: CVE-2013-6347
Published: 2013-11-02
Description: Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.novell.com/support/kb/doc.php?id=7012027; http://www.novell.com/support/kb/doc.php?id=7012027
CVE: CVE-2013-6023
Published: 2013-11-02
Description: Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbitrary files via .. (dot dot) in the URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://alguienenlafisi.blogspot.com/2013/10/dvr-tvt-directory-traversal.html; http://www.exploit-db.com/exploits/29959; http://www.kb.cert.org/vuls/id/785838
CVE: CVE-2013-6111
Published: 2013-11-02
Description: Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.x, 1.0.22.7, 1.1.x, 1.24.1, 1.3.25.1 through 1.3.25.4, 1.4.26.1 through 1.4.26.4, 1.5.27.1 through 1.5.27.3, and 1.6.29.1 through 1.6.29.6 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99081; http://secunia.com/advisories/55429; http://www.securitytracker.com/id/1029262
CVE: CVE-2013-6348
Published: 2013-11-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://en.wooyun.org/bugs/wooyun-2013-034?2592; http://osvdb.org/99047; http://osvdb.org/99048
CVE: CVE-2013-6349
Published: 2013-11-02
Description: McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/98669; https://kc.mcafee.com/corporate/index?page=content&id=SB10057; http://osvdb.org/98669
CVE: CVE-2013-2058
Published: 2013-11-04
Description: The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=929473ea05db455ad88cdc081f2adc556b8dc48f; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.4; http://www.openwall.com/lists/oss-security/2013/05/05/2
CVE: CVE-2013-4348
Published: 2013-11-04
Description: The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://rhn.redhat.com/errata/RHSA-2013-1490.html; http://www.ubuntu.com/usn/USN-2070-1
CVE: CVE-2013-4470
Published: 2013-11-04
Description: The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
CVE: CVE-2013-4483
Published: 2013-11-04
Description: The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6062a8dc0517bce23e3c2f7d2fea5e22411269a3; http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html; http://rhn.redhat.com/errata/RHSA-2014-0285.html
CVE: CVE-2013-6114
Published: 2013-11-04
Description: Integer overflow in the OZDocument::parseElement function in Apple Motion 5.0.7 allows remote attackers to cause a denial of service (application crash) via a (1) large or (2) small value in the subview attribute of a viewer element in a .motn file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://support.apple.com/kb/HT6041; http://www.exploit-db.com/exploits/28811/; http://support.apple.com/kb/HT6041
CVE: CVE-2013-4834
Published: 2013-11-04
Description: Unspecified vulnerability in the client component in HP Application LifeCycle Management (ALM) before 11 p11 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1327.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969433; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969433