deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1704
Published: 2013-08-07
Description: Use-after-free vulnerability in the nsINode::GetParentNode function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a DOM modification at the time of a SetBody mutation event.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.mozilla.org/security/announce/2013/mfsa2013-64.html; https://bugzilla.mozilla.org/show_bug.cgi?id=883313; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18945
CVE: CVE-2013-1705
Published: 2013-08-07
Description: Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00060.html; http://www.mozilla.org/security/announce/2013/mfsa2013-65.html
CVE: CVE-2013-1706
Published: 2013-08-07
Description: Stack-based buffer overflow in maintenanceservice.exe in the Mozilla Maintenance Service in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.mozilla.org/security/announce/2013/mfsa2013-66.html; https://bugzilla.mozilla.org/show_bug.cgi?id=888361; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18930
CVE: CVE-2013-1707
Published: 2013-08-07
Description: Stack-based buffer overflow in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line to the Mozilla Maintenance Service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.mozilla.org/security/announce/2013/mfsa2013-66.html; https://bugzilla.mozilla.org/show_bug.cgi?id=888314; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18871
CVE: CVE-2013-1708
Published: 2013-08-07
Description: Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (application crash) via a crafted WAV file that is not properly handled by the nsCString::CharAt function.
CVSS Score: 4.3 (MEDIUM)
References: http://www.mozilla.org/security/announce/2013/mfsa2013-67.html; https://bugzilla.mozilla.org/show_bug.cgi?id=879924; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18803
CVE: CVE-2013-1709
Published: 2013-08-07
Description: Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving spoofing a relative location in a previously visited document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2013/dsa-2735; http://www.debian.org/security/2013/dsa-2746; http://www.mozilla.org/security/announce/2013/mfsa2013-68.html
CVE: CVE-2013-1710
Published: 2013-08-07
Description: The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2013/dsa-2735; http://www.debian.org/security/2013/dsa-2746; http://www.mozilla.org/security/announce/2013/mfsa2013-69.html
CVE: CVE-2013-1711
Published: 2013-08-07
Description: The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mozilla.org/security/announce/2013/mfsa2013-70.html; https://bugzilla.mozilla.org/show_bug.cgi?id=843829; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18830
CVE: CVE-2013-1712
Published: 2013-08-07
Description: Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://www.mozilla.org/security/announce/2013/mfsa2013-71.html; https://bugzilla.mozilla.org/show_bug.cgi?id=859072; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18014
CVE: CVE-2013-1713
Published: 2013-08-07
Description: Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks or install arbitrary add-ons via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2013/dsa-2735; http://www.debian.org/security/2013/dsa-2746; http://www.mozilla.org/security/announce/2013/mfsa2013-72.html
CVE: CVE-2013-1714
Published: 2013-08-07
Description: The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 does not properly restrict XMLHttpRequest calls, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2013/dsa-2735; http://www.debian.org/security/2013/dsa-2746; http://www.mozilla.org/security/announce/2013/mfsa2013-73.html
CVE: CVE-2013-1715
Published: 2013-08-07
Description: Multiple untrusted search path vulnerabilities in the (1) full installer and (2) stub installer in Mozilla Firefox before 23.0 on Windows allow local users to gain privileges via a Trojan horse DLL in the default downloads directory.  NOTE: this issue exists because of an incomplete fix for CVE-2012-4206.
CVSS Score: 6.9 (MEDIUM)
References: http://www.mozilla.org/security/announce/2013/mfsa2013-74.html; https://bugzilla.mozilla.org/show_bug.cgi?id=883165; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18210
CVE: CVE-2013-1717
Published: 2013-08-07
Description: Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2013/dsa-2735; http://www.debian.org/security/2013/dsa-2746; http://www.mozilla.org/security/announce/2013/mfsa2013-75.html
CVE: CVE-2013-3454
Published: 2013-08-08
Description: Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform arbitrary actions via HTTPS requests, aka Bug ID CSCui43128.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130807-tp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130807-tp
CVE: CVE-2013-3256
Published: 2013-08-08
Description: Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authentication of users for requests that "manipulate plugin settings."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53138; http://wordpress.org/plugins/sexybookmarks/changelog/; http://www.securityfocus.com/bid/61561
CVE: CVE-2013-3027
Published: 2013-08-09
Description: Integer overflow in the DWA9W ActiveX control in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to execute arbitrary code via a crafted web page, aka SPR PTHN97XHFW.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www-01.ibm.com/support/docview.wss?uid=swg21644599; http://www-01.ibm.com/support/docview.wss?uid=swg21645503; https://exchange.xforce.ibmcloud.com/vulnerabilities/84381
CVE: CVE-2013-3032
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN986NAA.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21644599; http://www-01.ibm.com/support/docview.wss?uid=swg21645503; https://exchange.xforce.ibmcloud.com/vulnerabilities/84622
CVE: CVE-2013-3544
Published: 2013-08-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-3544.  Reason: This candidate is a duplicate of CVE-2012-3544.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-3544 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3659
Published: 2013-08-09
Description: The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points, which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverage area.
CVSS Score: 3.3 (LOW)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN44035194/995312/index.html; http://jvn.jp/en/jp/JVN44035194/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000075
CVE: CVE-2013-3990
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN98FLQ2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21644599; http://www-01.ibm.com/support/docview.wss?uid=swg21645503; https://exchange.xforce.ibmcloud.com/vulnerabilities/84971
CVE: CVE-2013-4943
Published: 2013-08-09
Description: The client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0 before 10.0.3.0.19 allows local users to gain privileges and bypass intended database-operation restrictions by leveraging COMOS project access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-970879.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-970879.pdf
CVE: CVE-2013-0150
Published: 2013-08-09
Description: Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a ..  (dot dot) in the filename parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/53477; http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14468.html; https://nealpoole.com/blog/2013/07/code-execution-via-f5-networks-java-applet/
CVE: CVE-2013-2117
Published: 2013-08-09
Description: Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6; http://lists.opensuse.org/opensuse-updates/2013-07/msg00061.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00012.html
CVE: CVE-2013-3253
Published: 2013-08-09
Description: Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://forum.xhanch.com/index.php/topic%2C3806.0.html; http://plugins.trac.wordpress.org/changeset/750054/xhanch-my-twitter; http://secunia.com/advisories/53133
CVE: CVE-2013-3480
Published: 2013-08-09
Description: Integer overflow in Sagelight 4.4 and earlier allows remote attackers to execute arbitrary code via crafted width and height dimensions in a BMP file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/52705; http://www.securityfocus.com/bid/61408; https://exchange.xforce.ibmcloud.com/vulnerabilities/85920
CVE: CVE-2013-2576
Published: 2013-08-09
Description: Buffer overflow in Artweaver before 3.1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AWD file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0154.html; http://osvdb.org/95573; http://secunia.com/advisories/54167
CVE: CVE-2013-2577
Published: 2013-08-09
Description: Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0153.html; http://newsgroup.xnview.com/viewtopic.php?f=35&t=28400; http://osvdb.org/95580
CVE: CVE-2013-3262
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset/723187/download-monitor; http://secunia.com/advisories/53116; http://www.securityfocus.com/bid/61407
CVE: CVE-2013-4147
Published: 2013-08-09
Description: Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in a request in the (1) log_msg function in log.c or (2) version or (3) build_version function in version.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714612; http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://osvdb.org/95518
CVE: CVE-2013-4600
Published: 2013-08-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to system/login/index.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0113.html; http://www.opencms.org/en/news/130710-opencms-v852-releasenotes.html; https://github.com/alkacon/opencms-core/issues/173
CVE: CVE-2013-4619
Published: 2013-08-09
Description: Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/chart_tracker.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/54083; http://sourceforge.net/p/openemr/code/ci/8a8a4607ba5ae2b9eb6b6a3b1b8ed7c6ea7e03b1/; http://sourceforge.net/p/openemr/discussion/202506/thread/4854b2b1/#9658
CVE: CVE-2013-4620
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/54083; http://sourceforge.net/p/openemr/code/ci/8a8a4607ba5ae2b9eb6b6a3b1b8ed7c6ea7e03b1/; http://sourceforge.net/p/openemr/discussion/202506/thread/4854b2b1/#9658
CVE: CVE-2013-4625
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0161.html; http://osvdb.org/95627; http://packetstormsecurity.com/files/122535/WordPress-Duplicator-0.4.4-Cross-Site-Scripting.html
CVE: CVE-2013-4742
Published: 2013-08-09
Description: Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string within the authentication request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0149.html; http://osvdb.org/95582; http://secunia.com/advisories/54188
CVE: CVE-2013-4759
Published: 2013-08-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) fullname, or (3) email parameter to magnoliaPublic/demo-project/members-area/registration.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0160.html; http://osvdb.org/95628; http://packetstormsecurity.com/files/122527/Magnolia-CMS-5.0.1-Community-Edition-Cross-Site-Scripting.html
CVE: CVE-2013-4789
Published: 2013-08-09
Description: SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95842; http://secunia.com/advisories/54289; http://www.cotonti.com/forums?m=posts&q=7475
CVE: CVE-2013-5098
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset/723187/download-monitor; http://secunia.com/advisories/53116; http://www.securityfocus.com/bid/61407
CVE: CVE-2013-5099
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field.  NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are used by article.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/26958; http://www.securityfocus.com/bid/61376; https://exchange.xforce.ibmcloud.com/vulnerabilities/85888
CVE: CVE-2012-6458
Published: 2013-08-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName, (2) Surname, or (3) Email parameter to code/forms/OrderFormAddress.php; or the (4) FirstName or (5) Surname parameter to code/forms/ShopAccountForm.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0090.html; https://code.google.com/p/silverstripe-ecommerce/source/detail?r=3739; http://archives.neohapsis.com/archives/bugtraq/2013-07/0090.html
CVE: CVE-2013-4115
Published: 2013-08-09
Description: Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00024.html
CVE: CVE-2013-5100
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007) extension before 0.10.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the t3lib_div::quoteJSvalue function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/89131; http://secunia.com/advisories/51836; http://typo3.org/extensions/repository/view/div2007
CVE: CVE-2012-3039
Published: 2013-08-09
Description: Moxa OnCell Gateway G3111, G3151, G3211, and G3251 devices with firmware before 1.4 do not use a sufficient source of entropy for SSH and SSL keys, which makes it easier for remote attackers to obtain access by leveraging knowledge of a key from a product installation elsewhere.
CVSS Score: 7.1 (HIGH)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-217-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-217-01
CVE: CVE-2013-0492
Published: 2013-08-09
Description: Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21645601; https://exchange.xforce.ibmcloud.com/vulnerabilities/82007; http://www-01.ibm.com/support/docview.wss?uid=swg21645601
CVE: CVE-2013-0494
Published: 2013-08-09
Description: IBM Sterling B2B Integrator 5.0 and 5.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted HTTP (1) Range or (2) Request-Range header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC82726; http://www-01.ibm.com/support/docview.wss?uid=swg21627989; https://exchange.xforce.ibmcloud.com/vulnerabilities/82009
CVE: CVE-2013-2792
Published: 2013-08-09
Description: Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-219-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-219-01