deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6767
Published: 2013-12-20
Description: Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary code or cause a denial of service (process crash) via a long *.text value in a PE file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/101130; http://packetstormsecurity.com/files/124477/QuickHeal-AntiVirus-7.0.0.1-Stack-Buffer-Overflow.html; http://seclists.org/bugtraq/2013/Dec/90
CVE: CVE-2013-7186
Published: 2013-12-20
Description: Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/124282; http://packetstormsecurity.com/files/124283; http://packetstormsecurity.com/files/124284
CVE: CVE-2013-7187
Published: 2013-12-20
Description: SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/124343/wpformcraft-sql.txt; http://secunia.com/advisories/56044; http://www.exploit-db.com/exploits/30002
CVE: CVE-2013-7188
Published: 2013-12-20
Description: Cross-site scripting (XSS) vulnerability in KBKP Software HostBill before 2013-12-14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://extras.hostbillapp.com/security-advisory-hostbill-version-2013-12-14/; http://hostbillapp.com/changelog; http://osvdb.org/101030
CVE: CVE-2013-7189
Published: 2013-12-20
Description: Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter to payinvoiceothers.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101049; http://osvdb.org/101050; http://osvdb.org/101051
CVE: CVE-2013-7190
Published: 2013-12-20
Description: Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2013/Dec/121; https://exchange.xforce.ibmcloud.com/vulnerabilities/89818; http://seclists.org/fulldisclosure/2013/Dec/121
CVE: CVE-2013-2627
Published: 2013-12-21
Description: SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101156; http://seclists.org/bugtraq/2013/Dec/107; http://www.csnc.ch/misc/files/advisories/CSNC-2013-005-006-007_Leed_Multiple_vulns.txt
CVE: CVE-2013-2628
Published: 2013-12-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in action.php in Leed (Light Feed), possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101154; http://seclists.org/bugtraq/2013/Dec/107; http://www.csnc.ch/misc/files/advisories/CSNC-2013-005-006-007_Leed_Multiple_vulns.txt
CVE: CVE-2013-6162
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/30373; https://exchange.xforce.ibmcloud.com/vulnerabilities/89807; http://www.exploit-db.com/exploits/30373
CVE: CVE-2013-7002
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in mobile/php/translation/index.php in LiveZilla before 5.1.1.0 allows remote attackers to inject arbitrary web script or HTML via the g_language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0032.html; http://packetstormsecurity.com/files/124344; http://ropchain.org/advisories/CVE-2013-7002.txt
CVE: CVE-2013-7074
Published: 2013-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/100881; http://seclists.org/oss-sec/2013/q4/473; http://seclists.org/oss-sec/2013/q4/487
CVE: CVE-2013-7076
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100883; http://seclists.org/oss-sec/2013/q4/473; http://seclists.org/oss-sec/2013/q4/487
CVE: CVE-2013-7077
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100884; http://seclists.org/oss-sec/2013/q4/473; http://seclists.org/oss-sec/2013/q4/487
CVE: CVE-2013-7082
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100825; http://secunia.com/advisories/55996; http://typo3.org/teams/security/security-bulletins/typo3-flow/typo3-flow-sa-2013-001
CVE: CVE-2013-7191
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://makthepla.net/blog/=/helpdesk-pilot-add-admin; http://secunia.com/advisories/55797; https://exchange.xforce.ibmcloud.com/vulnerabilities/89510
CVE: CVE-2013-7192
Published: 2013-12-21
Description: Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/news-events/newdetail.asp, or the (2) UserID or (3) Password to login.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/124451; http://www.securityfocus.com/bid/64371; https://exchange.xforce.ibmcloud.com/vulnerabilities/89844
CVE: CVE-2013-7193
Published: 2013-12-21
Description: Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101075; http://osvdb.org/101076; http://packetstormsecurity.com/files/124441/c2cfac-sql.txt
CVE: CVE-2013-7194
Published: 2013-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Last name, (2) Lesson name, or (3) Course name field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124400; http://www.exploit-db.com/exploits/30213; https://exchange.xforce.ibmcloud.com/vulnerabilities/89660
CVE: CVE-2012-4131
Published: 2013-12-21
Description: Directory traversal vulnerability in tar in Cisco NX-OS allows local users to access arbitrary files via crafted command-line arguments, aka Bug IDs CSCty07157, CSCty07159, CSCty07162, and CSCty07164.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4131; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4131
CVE: CVE-2012-4135
Published: 2013-12-21
Description: Directory traversal vulnerability in filesys in Cisco NX-OS 6.1(2) and earlier allows local users to access arbitrary files via crafted command-line arguments during a delete action, aka Bug IDs CSCty07270, CSCty07271, CSCty07273, and CSCty07275.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4135; http://tools.cisco.com/security/center/viewAlert.x?alertId=32237; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4135
CVE: CVE-2013-2821
Published: 2013-12-21
Description: NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service (driver crash and process restart) via a crafted DNP3 TCP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-352-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-352-01
CVE: CVE-2013-2822
Published: 2013-12-21
Description: NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service (driver crash and process restart) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-352-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-352-01
CVE: CVE-2013-4044
Published: 2013-12-21
Description: IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95817; http://www-01.ibm.com/support/docview.wss?uid=swg21660191; https://exchange.xforce.ibmcloud.com/vulnerabilities/86420
CVE: CVE-2013-4045
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in the Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95817; http://www-01.ibm.com/support/docview.wss?uid=swg21660191; https://exchange.xforce.ibmcloud.com/vulnerabilities/86421
CVE: CVE-2013-4046
Published: 2013-12-21
Description: Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95817; http://www-01.ibm.com/support/docview.wss?uid=swg21660191; https://exchange.xforce.ibmcloud.com/vulnerabilities/86439
CVE: CVE-2013-4063
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPRs PTHN9AQMV7 and TCLE98ZKRP.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21659959; https://exchange.xforce.ibmcloud.com/vulnerabilities/86594; http://www-01.ibm.com/support/docview.wss?uid=swg21659959
CVE: CVE-2013-4064
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN9ARMFA.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21659959; https://exchange.xforce.ibmcloud.com/vulnerabilities/86595; http://www-01.ibm.com/support/docview.wss?uid=swg21659959
CVE: CVE-2013-4065
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21659959; https://exchange.xforce.ibmcloud.com/vulnerabilities/86596; http://www-01.ibm.com/support/docview.wss?uid=swg21659959
CVE: CVE-2013-4069
Published: 2013-12-21
Description: The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95817; http://www-01.ibm.com/support/docview.wss?uid=swg21660191; https://exchange.xforce.ibmcloud.com/vulnerabilities/86621
CVE: CVE-2013-4070
Published: 2013-12-21
Description: The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM95817; http://www-01.ibm.com/support/docview.wss?uid=swg21660191; https://exchange.xforce.ibmcloud.com/vulnerabilities/86656
CVE: CVE-2013-5405
Published: 2013-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96053; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; http://www.securityfocus.com/bid/64443
CVE: CVE-2013-5406
Published: 2013-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, leading to improper interaction with the Windows MHTML protocol handler.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96055; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; http://www.securityfocus.com/bid/64446
CVE: CVE-2013-5407
Published: 2013-12-21
Description: IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection" issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96057; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; https://exchange.xforce.ibmcloud.com/vulnerabilities/87356
CVE: CVE-2013-5409
Published: 2013-12-21
Description: Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96049; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; https://exchange.xforce.ibmcloud.com/vulnerabilities/87358
CVE: CVE-2013-5411
Published: 2013-12-21
Description: IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96059; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; https://exchange.xforce.ibmcloud.com/vulnerabilities/87360
CVE: CVE-2013-5413
Published: 2013-12-21
Description: IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96051; http://www-01.ibm.com/support/docview.wss?uid=swg21657539; https://exchange.xforce.ibmcloud.com/vulnerabilities/87362
CVE: CVE-2013-6196
Published: 2013-12-21
Description: Cross-site scripting (XSS) vulnerability in HP Autonomy Ultraseek 5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04041082; http://jvn.jp/en/jp/JVN69700259/index.html; http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000126.html
CVE: CVE-2013-6978
Published: 2013-12-21
Description: The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/101162; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6978; http://tools.cisco.com/security/center/viewAlert.x?alertId=32219
CVE: CVE-2013-6995
Published: 2013-12-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-3705
Published: 2013-12-22
Description: The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://download.novell.com/Download?buildid=gCT45TxxTHQ~; http://www.novell.com/support/kb/doc.php?id=7014276; http://download.novell.com/Download?buildid=gCT45TxxTHQ~
CVE: CVE-2013-4012
Published: 2013-12-22
Description: IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF09, when Content Template Catalog 4.0 is used, does not require administrative privileges for Portal Application Archive (PAA) file installation, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM93172; http://www-01.ibm.com/support/docview.wss?uid=swg21660011; https://exchange.xforce.ibmcloud.com/vulnerabilities/85618
CVE: CVE-2013-5421
Published: 2013-12-22
Description: Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21660210; https://exchange.xforce.ibmcloud.com/vulnerabilities/87483; http://www-01.ibm.com/support/docview.wss?uid=swg21660210
CVE: CVE-2013-6316
Published: 2013-12-22
Description: IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in a Web Content Manager (WCM) context processor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/101270; http://www-01.ibm.com/support/docview.wss?uid=swg1PI04897; http://www-01.ibm.com/support/docview.wss?uid=swg21660011
CVE: CVE-2013-6328
Published: 2013-12-22
Description: Cross-site scripting (XSS) vulnerability in the Web Content Manager (WCM) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101269; http://www-01.ibm.com/support/docview.wss?uid=swg1PM96345; http://www-01.ibm.com/support/docview.wss?uid=swg21660011
CVE: CVE-2013-6723
Published: 2013-12-22
Description: IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager (WCM) navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/101271; http://www-01.ibm.com/support/docview.wss?uid=swg1PI05684; http://www-01.ibm.com/support/docview.wss?uid=swg21660011
CVE: CVE-2013-6735
Published: 2013-12-22
Description: IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/101255; http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.html; http://secunia.com/advisories/56161
CVE: CVE-2013-6745
Published: 2013-12-22
Description: Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21660569; http://www.securityfocus.com/bid/64475; https://exchange.xforce.ibmcloud.com/vulnerabilities/89861
CVE: CVE-2013-5973
Published: 2013-12-23
Description: VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator role for a vCenter Server Add Existing Disk action with a (1) -flat, (2) -rdm, or (3) -rdmp filename.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN13154935/index.html; http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000123.html; http://osvdb.org/101387
CVE: CVE-2013-2629
Published: 2013-12-23
Description: Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm, (2) importFeed, (3) addFavorite, or (4) removeFavorite actions in action.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2013/Dec/107; http://www.csnc.ch/misc/files/advisories/CSNC-2013-005-006-007_Leed_Multiple_vulns.txt; http://seclists.org/bugtraq/2013/Dec/107