deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1296
Published: 2013-04-09
Description: The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows remote RDP servers to execute arbitrary code via unspecified vectors that trigger access to a deleted object, aka "RDP ActiveX Control Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/ncas/alerts/TA13-100A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-029; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16598
CVE: CVE-2013-1303
Published: 2013-04-09
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1304 and CVE-2013-1338.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-100A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-028; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16662
CVE: CVE-2013-1304
Published: 2013-04-09
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1303 and CVE-2013-1338.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-100A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-028; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16515
CVE: CVE-2013-1378
Published: 2013-04-10
Description: Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html
CVE: CVE-2013-1379
Published: 2013-04-10
Description: Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html
CVE: CVE-2013-1380
Published: 2013-04-10
Description: Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1378.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html
CVE: CVE-2013-1383
Published: 2013-04-10
Description: Buffer overflow in Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-12.html; http://www.adobe.com/support/security/bulletins/apsb13-12.html
CVE: CVE-2013-1384
Published: 2013-04-10
Description: Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1386.
CVSS Score: 10.0 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb13-12.html; http://www.adobe.com/support/security/bulletins/apsb13-12.html
CVE: CVE-2013-1385
Published: 2013-04-10
Description: Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.adobe.com/support/security/bulletins/apsb13-12.html; http://www.adobe.com/support/security/bulletins/apsb13-12.html
CVE: CVE-2013-1386
Published: 2013-04-10
Description: Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1384.
CVSS Score: 10.0 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb13-12.html; http://www.adobe.com/support/security/bulletins/apsb13-12.html
CVE: CVE-2013-1387
Published: 2013-04-10
Description: Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb13-10.html; http://www.adobe.com/support/security/bulletins/apsb13-10.html
CVE: CVE-2013-1388
Published: 2013-04-10
Description: Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb13-10.html; http://www.adobe.com/support/security/bulletins/apsb13-10.html
CVE: CVE-2012-6120
Published: 2013-04-10
Description: Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0710.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html
CVE: CVE-2013-1815
Published: 2013-04-10
Description: A flaw was found in PackStack. This vulnerability allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creation could lead to unauthorized system modifications.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-379, CWE-255
References: http://rhn.redhat.com/errata/RHSA-2013-0671.html; https://access.redhat.com/security/cve/CVE-2013-1815; https://bugzilla.redhat.com/show_bug.cgi?id=917904
CVE: CVE-2013-1912
Published: 2013-04-10
Description: Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103730.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103770.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103794.html
CVE: CVE-2013-2716
Published: 2013-04-10
Description: Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/52862; https://exchange.xforce.ibmcloud.com/vulnerabilities/83171; https://puppetlabs.com/security/cve/cve-2013-2716/
CVE: CVE-2013-2766
Published: 2013-04-10
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.3.0 through 4.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/59038; http://www.securitytracker.com/id/1028371; http://www.splunk.com/view/SP-CAAAHSQ
CVE: CVE-2013-0927
Published: 2013-04-10
Description: Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c read_config implementation that loads the contents of the .pangorc file in the user's home directory, and the file referenced by the PANGO_RC_FILE environment variable, which allows attackers to bypass intended access restrictions via crafted configuration data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://git.chromium.org/gitweb/?p=chromiumos/overlays/chromiumos-overlay.git%3Ba=commit%3Bh=fb5a664def6cd34bf7295489ea73e1d989bdd6d0; http://googlechromereleases.blogspot.com/2013/04/chrome-os-stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=189250
CVE: CVE-2013-1149
Published: 2013-04-11
Description: Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.28), 8.1 and 8.2 before 8.2(5.35), 8.3 before 8.3(2.34), 8.4 before 8.4(4.11), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3), and Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(24.1) and 4.0 and 4.1 before 4.1(11.1), allow remote attackers to cause a denial of service (device reload) via a crafted IKEv1 message, aka Bug IDs CSCub85692 and CSCud20267.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-fwsm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa
CVE: CVE-2013-1150
Published: 2013-04-11
Description: The authentication-proxy implementation on Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5.3), 8.5 and 8.6 before 8.6(1.10), 8.7 before 8.7(1.4), 9.0 before 9.0(1.1), and 9.1 before 9.1(1.2) allows remote attackers to cause a denial of service (device reload) via a crafted URL, aka Bug ID CSCud16590.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1150; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa
CVE: CVE-2013-1151
Published: 2013-04-11
Description: Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5), 8.5 before 8.5(1.17), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3) allow remote attackers to cause a denial of service (device reload) via a crafted certificate, aka Bug ID CSCuc72408.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa
CVE: CVE-2013-1152
Published: 2013-04-11
Description: Cisco Adaptive Security Appliances (ASA) devices with software 9.0 before 9.0(1.2) allow remote attackers to cause a denial of service (device reload) via a crafted field in a DNS message, aka Bug ID CSCuc80080.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asa
CVE: CVE-2013-1155
Published: 2013-04-11
Description: The auth-proxy functionality in Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(20.1), 4.0 before 4.0(15.2), and 4.1 before 4.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted URL, aka Bug ID CSCtg02624.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-fwsm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-fwsm
CVE: CVE-2013-1164
Published: 2013-04-11
Description: Cisco IOS XE 3.4 before 3.4.4S, 3.5, and 3.6 on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 multicast packets, aka Bug ID CSCtz97563.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000
CVE: CVE-2013-1165
Published: 2013-04-11
Description: Cisco IOS XE 2.x and 3.x before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) allows remote attackers to cause a denial of service (card reload) by sending many crafted L2TP packets, aka Bug ID CSCtz23293.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000
CVE: CVE-2013-1166
Published: 2013-04-11
Description: Cisco IOS XE 3.2 through 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR), when VRF-aware NAT and SIP ALG are enabled, allows remote attackers to cause a denial of service (card reload) by sending many SIP packets, aka Bug ID CSCuc65609.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000
CVE: CVE-2013-1167
Published: 2013-04-11
Description: Cisco IOS XE 3.2 through 3.4 before 3.4.2S, and 3.5, on 1000 series Aggregation Services Routers (ASR), when bridge domain interface (BDI) is enabled, allows remote attackers to cause a denial of service (card reload) via packets that are not properly handled during the processing of encapsulation, aka Bug ID CSCtt11558.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000
CVE: CVE-2013-1168
Published: 2013-04-11
Description: The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a session cookie, aka Bug ID CSCuc64885.
CVSS Score: 7.6 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-mp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-mp
CVE: CVE-2013-1169
Published: 2013-04-11
Description: Cisco Unified MeetingPlace Web Conferencing Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 2, and 8.5 before 8.5MR3 Patch 1, when the Remember Me option is used, does not properly verify cookies, which allows remote attackers to impersonate users via a crafted login request, aka Bug ID CSCuc64846.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-mp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-mp
CVE: CVE-2013-1170
Published: 2013-04-11
Description: The Cisco Prime Network Control System (NCS) appliance with software before 1.1.1.24 has a default password for the database user account, which makes it easier for remote attackers to change the configuration or cause a denial of service (service disruption) via unspecified vectors, aka Bug ID CSCtz30468.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-ncs; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-ncs
CVE: CVE-2013-1172
Published: 2013-04-11
Description: The Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) does not properly verify files, which allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14153.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1172; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1172
CVE: CVE-2013-1173
Published: 2013-04-11
Description: Heap-based buffer overflow in ciscod.exe in the Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14143.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1173; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1173
CVE: CVE-2013-1189
Published: 2013-04-11
Description: Cisco Universal Broadband (aka uBR) 10000 series routers, when an IPv4/IPv6 dual-stack modem is used, allow remote attackers to cause a denial of service (routing-engine reload) via unspecified changes to IP address assignments, aka Bug ID CSCue15313.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1189; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1189
CVE: CVE-2013-2779
Published: 2013-04-11
Description: Cisco IOS XE 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 MVPN (aka MVPNv6) packets, aka Bug ID CSCub34945, a different vulnerability than CVE-2013-1164.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000
CVE: CVE-2012-5937
Published: 2013-04-12
Description: Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3, Sterling Integrator 5.0 and 5.1, and Sterling B2B Integrator 5.2, as used in IBM Sterling File Gateway 1.1 through 2.2 and other products, allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC85189; http://www.ibm.com/support/docview.wss?uid=swg21633925; https://exchange.xforce.ibmcloud.com/vulnerabilities/80403
CVE: CVE-2013-0501
Published: 2013-04-12
Description: The EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control, as used in Edraw Office Viewer Component, the client in IBM Cognos Disclosure Management (CDM) 10.2.0, and other products, allows remote attackers to read arbitrary files, or download an arbitrary program onto a client machine and execute this program, via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21627070; https://exchange.xforce.ibmcloud.com/vulnerabilities/82345; http://www.ibm.com/support/docview.wss?uid=swg21627070
CVE: CVE-2012-3532
Published: 2013-04-12
Description: Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2013-0733.html; http://secunia.com/advisories/53005; http://www.securityfocus.com/bid/59015
CVE: CVE-2012-6139
Published: 2013-04-12
Description: libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102065.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00020.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00028.html
CVE: CVE-2013-0270
Published: 2013-04-12
Description: A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284, CWE-119
References: http://rhn.redhat.com/errata/RHSA-2013-0708.html; https://access.redhat.com/security/cve/CVE-2013-0270; https://bugs.launchpad.net/keystone/+bug/1099025
CVE: CVE-2013-0282
Published: 2013-04-12
Description: OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/02/19/3; https://bugs.launchpad.net/keystone/+bug/1121494; https://launchpad.net/keystone/+milestone/2012.2.4
CVE: CVE-2013-0314
Published: 2013-04-12
Description: The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2013-0613.html; http://secunia.com/advisories/52552; http://www.osvdb.org/91120
CVE: CVE-2013-0315
Published: 2013-04-12
Description: The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0613.html; http://secunia.com/advisories/52552; http://www.osvdb.org/91121