deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5607
Published: 2013-11-20
Description: Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html
CVE: CVE-2013-6827
Published: 2013-11-20
Description: Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html
CVE: CVE-2013-6828
Published: 2013-11-20
Description: admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html
CVE: CVE-2013-6829
Published: 2013-11-20
Description: admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0133.html
CVE: CVE-2013-6830
Published: 2013-11-20
Description: admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0139.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0139.html
CVE: CVE-2013-6831
Published: 2013-11-20
Description: PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications, which allows local users to gain privileges via a sudo command that leverages access to the qmailq account.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0139.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0139.html
CVE: CVE-2013-5991
Published: 2013-11-21
Description: The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN61077110/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000104; http://www.ec-cube.net/info/weakness/weakness.php?id=54
CVE: CVE-2013-5992
Published: 2013-11-21
Description: Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN38790987/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000105; http://www.ec-cube.net/info/weakness/weakness.php?id=54
CVE: CVE-2013-5993
Published: 2013-11-21
Description: Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN11221613/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000097; http://svn.ec-cube.net/open_trac/changeset/23277
CVE: CVE-2013-5994
Published: 2013-11-21
Description: data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN06870202/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000098; http://svn.ec-cube.net/open_trac/changeset/23278
CVE: CVE-2013-5995
Published: 2013-11-21
Description: data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN55630933/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000106; http://svn.ec-cube.net/open_trac/changeset/23274
CVE: CVE-2013-5996
Published: 2013-11-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN06377589/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000107; http://svn.ec-cube.net/open_trac/changeset/23275
CVE: CVE-2013-6173
Published: 2013-11-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions in (1) xAdmin or (2) xDashboard.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html; http://osvdb.org/99985; http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html
CVE: CVE-2013-6174
Published: 2013-11-21
Description: Multiple open redirect vulnerabilities in xAdmin in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html; http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html; http://www.kb.cert.org/vuls/id/346982
CVE: CVE-2013-6175
Published: 2013-11-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject arbitrary web script or HTML via unspecified input to a (1) xAdmin or (2) xDashboard form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html; http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html; http://www.kb.cert.org/vuls/id/346982
CVE: CVE-2013-6176
Published: 2013-11-21
Description: Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute arbitrary SQL commands via unspecified input to a (1) xAdmin or (2) xDashboard form.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html; http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html; http://www.kb.cert.org/vuls/id/346982
CVE: CVE-2013-6177
Published: 2013-11-21
Description: Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allows remote authenticated users to read arbitrary files by leveraging xDashboard access.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html; http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html; http://www.kb.cert.org/vuls/id/346982
CVE: CVE-2013-6832
Published: 2013-11-21
Description: The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0106.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0106.html
CVE: CVE-2013-6833
Published: 2013-11-21
Description: The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0107.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0107.html
CVE: CVE-2013-6834
Published: 2013-11-21
Description: The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0107.html; http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0107.html
CVE: CVE-2013-2811
Published: 2013-11-22
Description: The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-297-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-297-02; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15805
CVE: CVE-2013-2823
Published: 2013-11-22
Description: The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-297-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-297-02; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15805
CVE: CVE-2013-6692
Published: 2013-11-22
Description: Cisco IOS XE 3.8S(.2) and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated users to cause a denial of service (device reload) via an AAA packet that triggers an address requirement, aka Bug ID CSCuh04949.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6692; http://tools.cisco.com/security/center/viewAlert.x?alertId=31860; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6692
CVE: CVE-2013-6693
Published: 2013-11-22
Description: The MLDP implementation in Cisco IOS 15.3(3)S and earlier on 7600 routers, when many VRFs are configured, allows remote attackers to cause a denial of service (chunk corruption and device reload) by establishing many multicast flows, aka Bug ID CSCue22345.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6693; http://tools.cisco.com/security/center/viewAlert.x?alertId=31861; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6693
CVE: CVE-2013-6852
Published: 2013-11-22
Description: Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/28562/; http://www.exploit-db.com/exploits/28562/
CVE: CVE-2013-3288
Published: 2013-11-22
Description: Cross-site scripting (XSS) vulnerability on the EMC RSA Data Protection Manager (DPM) appliance 3.2.x before 3.2.4.2 and 3.5.x before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html
CVE: CVE-2013-5997
Published: 2013-11-22
Description: Unspecified vulnerability in the SSH implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote authenticated users to cause a denial of service (device hang) via unknown vectors, a different vulnerability than CVE-2013-5998.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN65312543/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000109; http://jvn.jp/en/jp/JVN65312543/index.html
CVE: CVE-2013-5998
Published: 2013-11-22
Description: Unspecified vulnerability in the Web manager implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote attackers to cause a denial of service (device hang) via unknown vectors, a different vulnerability than CVE-2013-5997.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN28812735/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000110; http://jvn.jp/en/jp/JVN28812735/index.html
CVE: CVE-2013-5999
Published: 2013-11-22
Description: Kingsoft KDrive Personal before 1.21.0.1880 on Windows does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://faq.kdrive.jp/2013/11/19/pcappupdate.html; http://jvn.jp/en/jp/JVN97810280/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000108
CVE: CVE-2013-6312
Published: 2013-11-22
Description: Unspecified vulnerability in IBM Rational Service Tester 8.3.x and 8.5.x before 8.5.1 and Rational Performance Tester 8.3.x and 8.5.x before 8.5.1 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21655814; http://www-01.ibm.com/support/docview.wss?uid=swg21655815; https://exchange.xforce.ibmcloud.com/vulnerabilities/88593
CVE: CVE-2013-6694
Published: 2013-11-22
Description: The IPSec implementation in Cisco IOS allows remote attackers to cause a denial of service (MTU change and tunnel-session drop) via crafted ICMP packets, aka Bug ID CSCul29918.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6694; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6694
CVE: CVE-2013-6698
Published: 2013-11-22
Description: The web interface on Cisco Wireless LAN Controller (WLC) devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf77821.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6698; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6698
CVE: CVE-2013-6699
Published: 2013-11-22
Description: The Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service via a crafted CAPWAP packet that triggers a buffer over-read, aka Bug ID CSCuh81880.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6699; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6699
CVE: CVE-2013-6377
Published: 2013-11-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-6342
Published: 2013-11-22
Description: Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tb_tab_index parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0072.html; http://secunia.com/advisories/55780; http://wordpress.org/plugins/tweet-blender/changelog
CVE: CVE-2010-3443
Published: 2013-11-23
Description: ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.quassel-irc.org/issues/1023; http://bugs.quassel-irc.org/issues/1024; http://git.quassel-irc.org/?p=quassel.git%3Ba=commitdiff%3Bh=a4ca568cdf68cf4a0343eb161518dc8e50cea87d
CVE: CVE-2013-0281
Published: 2013-11-23
Description: Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2013-1635.html; https://bugzilla.redhat.com/show_bug.cgi?id=891922; https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93
CVE: CVE-2013-1813
Published: 2013-11-23
Description: util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965; http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784; http://lists.busybox.net/pipermail/busybox/2013-January/078864.html
CVE: CVE-2013-4473
Published: 2013-11-23
Description: Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/723124; http://cgit.freedesktop.org/poppler/poppler/commit/utils/pdfseparate.cc?id=b8682d868ddf7f741e93b; http://cgit.freedesktop.org/poppler/poppler/tree/NEWS
CVE: CVE-2013-4474
Published: 2013-11-23
Description: Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/723124; http://cgit.freedesktop.org/poppler/poppler/commit/?id=61f79b8447c3ac8ab5a26e79e0c28053ffdccf75; http://secunia.com/advisories/56567
CVE: CVE-2013-4481
Published: 2013-11-23
Description: Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2013-1603.html; https://bugzilla.redhat.com/show_bug.cgi?id=988998; http://rhn.redhat.com/errata/RHSA-2013-1603.html
CVE: CVE-2013-4482
Published: 2013-11-23
Description: Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.
CVSS Score: 6.2 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1603.html; https://bugzilla.redhat.com/show_bug.cgi?id=990321; http://rhn.redhat.com/errata/RHSA-2013-1603.html
CVE: CVE-2013-4485
Published: 2013-11-23
Description: 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-1752.html; http://rhn.redhat.com/errata/RHSA-2013-1753.html; http://secunia.com/advisories/55765
CVE: CVE-2013-4545
Published: 2013-11-23
Description: cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://curl.haxx.se/docs/adv_20131115.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html
CVE: CVE-2013-4589
Published: 2013-11-23
Description: The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120008.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html; http://secunia.com/advisories/55288
CVE: CVE-2013-6375
Published: 2013-11-23
Description: Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html; http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2013/11/20/3