deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4091
Published: 2013-10-05
Description: The RIP service engine in Cisco NX-OS allows remote attackers to cause a denial of service (engine restart) via a malformed (1) RIPv4 or (2) RIPv6 message, aka Bug ID CSCtj73415.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/98124; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4091; http://www.securityfocus.com/bid/62838
CVE: CVE-2012-4098
Published: 2013-10-05
Description: The BGP implementation in Cisco NX-OS does not properly filter AS paths, which allows remote attackers to cause a denial of service (BGP service reset and resync) via a malformed UPDATE message, aka Bug ID CSCtn13055.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/98129; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4098; https://exchange.xforce.ibmcloud.com/vulnerabilities/87675
CVE: CVE-2012-4122
Published: 2013-10-05
Description: The CLI parser in Cisco NX-OS allows local users to bypass intended access restrictions, and overwrite or create arbitrary files, via shell output redirection, aka Bug IDs CSCts56672 and CSCts56669.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/98121; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4122; http://www.securityfocus.com/bid/62843
CVE: CVE-2012-4141
Published: 2013-10-05
Description: Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/98122; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4141; http://www.securityfocus.com/bid/62839
CVE: CVE-2013-2808
Published: 2013-10-05
Description: Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053 SP2 allows remote attackers to execute arbitrary code via a crafted HTTP request to the Connect broker on TCP port 6000.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-277-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-277-01
CVE: CVE-2013-3610
Published: 2013-10-05
Description: qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/984366; http://www.kb.cert.org/vuls/id/984366
CVE: CVE-2013-3627
Published: 2013-10-05
Description: FrameworkService.exe in McAfee Framework Service in McAfee Managed Agent (MA) before 4.5.0.1927 and 4.6 before 4.6.0.3258 allows remote attackers to cause a denial of service (service crash) via a malformed HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/613886; https://kc.mcafee.com/corporate/index?page=content&id=SB10055; http://www.kb.cert.org/vuls/id/613886
CVE: CVE-2012-2255
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2256
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2257
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2258
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2259
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2260
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2261
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2262
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2263
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2264
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2265
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-2266
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2013-2098
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2099.  Reason: This candidate is a duplicate of CVE-2013-2099.  Notes: All CVE users should reference CVE-2013-2099 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2099
Published: 2013-10-09
Description: Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.python.org/issue17980; http://rhn.redhat.com/errata/RHSA-2014-1690.html; http://secunia.com/advisories/55107
CVE: CVE-2013-3128
Published: 2013-10-09
Description: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file, aka "OpenType Font Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082
CVE: CVE-2013-3195
Published: 2013-10-09
Description: The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted value in an argument to an ASP.NET web application, aka "Comctl32 Integer Overflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://blogs.technet.com/b/srd/archive/2013/10/08/assessing-risk-for-the-october-2013-security-updates.aspx; http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-083
CVE: CVE-2013-3200
Published: 2013-10-09
Description: The USB drivers in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18630
CVE: CVE-2013-3860
Published: 2013-10-09
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document, aka "Entity Expansion Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18517
CVE: CVE-2013-3861
Published: 2013-10-09
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18842
CVE: CVE-2013-3871
Published: 2013-10-09
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.technet.com/b/msrc/archive/2013/10/08/the-october-2013-security-updates.aspx; http://www.us-cert.gov/ncas/alerts/TA13-317A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080
CVE: CVE-2013-3872
Published: 2013-10-09
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3873, CVE-2013-3882, and CVE-2013-3885.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18601
CVE: CVE-2013-3873
Published: 2013-10-09
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3882, and CVE-2013-3885.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19060
CVE: CVE-2013-3874
Published: 2013-10-09
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18793
CVE: CVE-2013-3875
Published: 2013-10-09
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18909
CVE: CVE-2013-3879
Published: 2013-10-09
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18718
CVE: CVE-2013-3880
Published: 2013-10-09
Description: The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to bypass intended access restrictions and obtain sensitive information from a different container via a Trojan horse application, aka "App Container Elevation of Privilege Vulnerability."
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18912
CVE: CVE-2013-3881
Published: 2013-10-09
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a crafted application, aka "Win32k NULL Page Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18614
CVE: CVE-2013-3882
Published: 2013-10-09
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3873, and CVE-2013-3885.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18366
CVE: CVE-2013-3885
Published: 2013-10-09
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3873, and CVE-2013-3882.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18817
CVE: CVE-2013-3886
Published: 2013-10-09
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18811
CVE: CVE-2013-3888
Published: 2013-10-09
Description: dxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "DirectX Graphics Kernel Subsystem Double Fetch Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-399, CWE-367
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18924
CVE: CVE-2013-3889
Published: 2013-10-09
Description: Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server 2013 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-084; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-085
CVE: CVE-2013-3890
Published: 2013-10-09
Description: Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-085; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18926
CVE: CVE-2013-3891
Published: 2013-10-09
Description: Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-086; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18643
CVE: CVE-2013-3892
Published: 2013-10-09
Description: Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-086; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18953
CVE: CVE-2013-3894
Published: 2013-10-09
Description: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in a TrueType font (TTF) file, aka "TrueType Font CMAP Table Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18899
CVE: CVE-2013-3895
Published: 2013-10-09
Description: Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://blogs.technet.com/b/srd/archive/2013/10/08/assessing-risk-for-the-october-2013-security-updates.aspx; http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-084
CVE: CVE-2013-3896
Published: 2013-10-09
Description: Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
CVSS Score: 5.5 (MEDIUM)
References: http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
CVE: CVE-2013-3897
Published: 2013-10-09
Description: Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx; http://www.us-cert.gov/ncas/alerts/TA13-288A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080
CVE: CVE-2013-4256
Published: 2013-10-09
Description: Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://radscan.com/pipermail/nas/2013-August/001270.html; http://sourceforge.net/p/nas/code/288; http://www.debian.org/security/2013/dsa-2771
CVE: CVE-2013-4257
Published: 2013-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-4256.  Reason: This issue was MERGED into CVE-2013-4256 because it is the same type of vulnerability.  Notes: All CVE users should reference CVE-2013-4256 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4258
Published: 2013-10-09
Description: Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to syslog.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://radscan.com/pipermail/nas/2013-August/001270.html; http://radscan.com/pipermail/nas/2013-August/001277.html; http://sourceforge.net/mailarchive/forum.php?thread_name=E1Rp1rP-00038Z-VJ%40sfp-svn-6.v30.ch3.sourceforge.com&forum_name=nas-commits