deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2796
Published: 2013-08-09
Description: Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02; http://www.citect.schneider-electric.com/cs-HF720SP459363; http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02
CVE: CVE-2013-2798
Published: 2013-08-09
Description: Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-219-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-219-01
CVE: CVE-2013-4031
Published: 2013-08-09
Description: The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers has a default password for the IPMI user account, which makes it easier for remote attackers to perform power-on, power-off, or reboot actions, or add or modify accounts, via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463; https://exchange.xforce.ibmcloud.com/vulnerabilities/86172; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463
CVE: CVE-2013-4037
Published: 2013-08-09
Description: The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash to the client, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463; https://exchange.xforce.ibmcloud.com/vulnerabilities/86173; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463
CVE: CVE-2013-4038
Published: 2013-08-09
Description: The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading a file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463; https://exchange.xforce.ibmcloud.com/vulnerabilities/86174; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463
CVE: CVE-2013-3455
Published: 2013-08-12
Description: Cisco Finesse allows remote attackers to obtain sensitive information by sniffing the network for HTTP query data, aka Bug ID CSCug16732.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3455; http://www.securitytracker.com/id/1028897; https://exchange.xforce.ibmcloud.com/vulnerabilities/86357
CVE: CVE-2013-3457
Published: 2013-08-12
Description: Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3457; http://www.securitytracker.com/id/1028896; https://exchange.xforce.ibmcloud.com/vulnerabilities/86356
CVE: CVE-2013-4806
Published: 2013-08-12
Description: The OSPF implementation on HP JD9##A routers; HP J4###A, J484#B, J8###A, JD3##A, JE###A, and JF55#A switches; HP 3COM routers and switches; and HP H3C routers and switches does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote authenticated users to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
CVSS Score: 7.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/229804; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03880910; http://www.kb.cert.org/vuls/id/229804
CVE: CVE-2013-3464
Published: 2013-08-13
Description: Cisco IOS XR allows local users to cause a denial of service (Silicon Packet Processor memory corruption, improper mutex handling, and device reload) by starting an outbound flood of large ICMP Echo Request packets and stopping this with a CTRL-C sequence, aka Bug ID CSCui60347.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3464; http://www.securitytracker.com/id/1028914; https://exchange.xforce.ibmcloud.com/vulnerabilities/86385
CVE: CVE-2011-4718
Published: 2013-08-13
Description: Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=169b78eb79b0e080b67f9798708eb3771c6d0b2f; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=25e8fcc88fa20dc9d4c[PII_REDACTED]3f436927cde; https://bugs.php.net/bug.php?id=60491
CVE: CVE-2013-2790
Published: 2013-08-13
Description: The master-station DNP3 driver before driver19.exe, and Beta2041.exe, in IOServer allows remote attackers to cause a denial of service (infinite loop) via crafted DNP3 packets to TCP port 20000.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-213-03; http://ics-cert.us-cert.gov/advisories/ICSA-13-213-03
CVE: CVE-2013-3175
Published: 2013-08-14
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request, aka "Remote Procedure Call Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://vrt-blog.snort.org/2013/08/microsoft-update-tuesday-august-2013.html; http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-062
CVE: CVE-2013-3181
Published: 2013-08-14
Description: usp10.dll in the Unicode Scripts Processor in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Uniscribe Font Parsing Engine Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-060; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17442
CVE: CVE-2013-3182
Published: 2013-08-14
Description: The Windows NAT Driver (aka winnat) service in Microsoft Windows Server 2012 does not properly validate memory addresses during the processing of ICMP packets, which allows remote attackers to cause a denial of service (memory corruption and system hang) via crafted packets, aka "Windows NAT Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-064; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18199
CVE: CVE-2013-3183
Published: 2013-08-14
Description: The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly perform memory allocation for inbound ICMPv6 packets, which allows remote attackers to cause a denial of service (system hang) via crafted packets, aka "ICMPv6 Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-065; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17918
CVE: CVE-2013-3184
Published: 2013-08-14
Description: Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18271
CVE: CVE-2013-3185
Published: 2013-08-14
Description: Microsoft Active Directory Federation Services (AD FS) 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by connecting to an endpoint, aka "AD FS Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-066; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18318
CVE: CVE-2013-3186
Published: 2013-08-14
Description: The Protected Mode feature in Microsoft Internet Explorer 7 through 10 on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly implement the Integrity Access Level (aka IL) protection mechanism, which allows remote attackers to obtain medium-integrity privileges by leveraging access to a low-integrity process, aka "Process Integrity Level Assignment Vulnerability."
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18031; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059
CVE: CVE-2013-3187
Published: 2013-08-14
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3191 and CVE-2013-3193.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18137
CVE: CVE-2013-3188
Published: 2013-08-14
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3189.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17942
CVE: CVE-2013-3189
Published: 2013-08-14
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3188.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18354
CVE: CVE-2013-3190
Published: 2013-08-14
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18037
CVE: CVE-2013-3191
Published: 2013-08-14
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3187 and CVE-2013-3193.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18269
CVE: CVE-2013-3192
Published: 2013-08-14
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17980; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059
CVE: CVE-2013-3193
Published: 2013-08-14
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3187 and CVE-2013-3191.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17996
CVE: CVE-2013-3194
Published: 2013-08-14
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18267
CVE: CVE-2013-3196
Published: 2013-08-14
Description: The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3197 and CVE-2013-3198.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-063; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18175
CVE: CVE-2013-3197
Published: 2013-08-14
Description: The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3196 and CVE-2013-3198.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-063; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18364
CVE: CVE-2013-3198
Published: 2013-08-14
Description: The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3196 and CVE-2013-3197.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-063; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18421
CVE: CVE-2013-3199
Published: 2013-08-14
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-225A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18203
CVE: CVE-2013-4879
Published: 2013-08-14
Description: SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html; http://osvdb.org/96007; https://exchange.xforce.ibmcloud.com/vulnerabilities/86285
CVE: CVE-2013-4880
Published: 2013-08-14
Description: Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html; http://osvdb.org/96008; https://exchange.xforce.ibmcloud.com/vulnerabilities/86287
CVE: CVE-2013-2078
Published: 2013-08-14
Description: Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml; http://www.debian.org/security/2014/dsa-3006
CVE: CVE-2013-2126
Published: 2013-08-14
Description: Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2013-06/msg00193.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00195.html; http://secunia.com/advisories/53547
CVE: CVE-2013-2127
Published: 2013-08-14
Description: Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/53547; http://www.libraw.org/news/libraw-0-15-1; http://www.openwall.com/lists/oss-security/2013/05/29/7
CVE: CVE-2013-5120
Published: 2013-08-14
Description: SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender] parameter to user/browse/view_/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0048.html; http://osvdb.org/96028; http://www.exploit-db.com/exploits/27430
CVE: CVE-2013-5121
Published: 2013-08-14
Description: SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_by] parameter to user/browse/view_/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0048.html; http://osvdb.org/96028; http://www.exploit-db.com/exploits/27430
CVE: CVE-2013-2137
Published: 2013-08-15
Description: Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0144.html; http://ofbiz.apache.org/download.html#vulnerabilities; http://osvdb.org/95523
CVE: CVE-2013-2250
Published: 2013-08-15
Description: Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.html; http://ofbiz.apache.org/download.html#vulnerabilities; http://osvdb.org/95522
CVE: CVE-2013-1942
Published: 2013-08-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]5921&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7858&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1563&w=2
CVE: CVE-2013-2023
Published: 2013-08-15
Description: Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]5921&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7858&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1563&w=2