deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5933
Published: 2013-09-25
Description: Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service (memory corruption) by writing a long string to the /dev/socket/init_runit socket that is inconsistent with a certain length value that was previously written to this socket.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://twitter.com/djrbliss/statuses/[PII_REDACTED]46402304; https://plus.google.com/[PII_REDACTED][PII_REDACTED]/posts/5ofgPNrSu3J; http://twitter.com/djrbliss/statuses/[PII_REDACTED]46402304
CVE: CVE-2013-5934
Published: 2013-09-25
Description: Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different vulnerability than CVE-2013-5200.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html
CVE: CVE-2013-5935
Published: 2013-09-25
Description: The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended location, a different vulnerability than CVE-2013-5200.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html
CVE: CVE-2013-5936
Published: 2013-09-25
Description: The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call, a different vulnerability than CVE-2013-5200.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html; http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html
CVE: CVE-2013-5586
Published: 2013-09-25
Description: Cross-site scripting (XSS) vulnerability in wikka.php in WikkaWiki before 1.3.4-p1 allows remote attackers to inject arbitrary web script or HTML via the wakka parameter to sql/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-09/0048.html; http://docs.wikkawiki.org/WhatsNew134; http://osvdb.org/97183
CVE: CVE-2013-5937
Published: 2013-09-25
Description: Cross-site request forgery (CSRF) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/97203; http://seclists.org/fulldisclosure/2013/Sep/64; http://www.openwall.com/lists/oss-security/2013/10/21/5
CVE: CVE-2013-5938
Published: 2013-09-25
Description: Cross-site scripting (XSS) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a confirmation form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/97204; http://seclists.org/fulldisclosure/2013/Sep/64; http://www.openwall.com/lists/oss-security/2013/10/21/5
CVE: CVE-2012-4079
Published: 2013-09-26
Description: The XML API service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) allows remote attackers to cause a denial of service (API service outage) via a malformed XML document in a packet, aka Bug ID CSCtg48206.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/54879; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4079; http://secunia.com/advisories/54879
CVE: CVE-2012-4088
Published: 2013-09-26
Description: The FTP server in Cisco Unified Computing System (UCS) has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/54682; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4088; http://www.securitytracker.com/id/1029102
CVE: CVE-2012-4092
Published: 2013-09-26
Description: The management interface in the Central Software component in Cisco Unified Computing System (UCS) does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/55034; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4092; http://secunia.com/advisories/55034
CVE: CVE-2013-0341
Published: 2013-09-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2013-2026
Published: 2013-09-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4971.  Reason: This candidate is a reservation duplicate of CVE-2011-4971.  Notes: All CVE users should reference CVE-2011-4971 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2229
Published: 2013-09-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2218.  Reason: This candidate is a reservation duplicate of CVE-2013-2218.  Notes: All CVE users should reference CVE-2013-2218 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-5575
Published: 2013-09-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-4626
Published: 2013-09-26
Description: Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0127.html; http://secunia.com/advisories/54515; http://wordpress.org/plugins/backwpup/changelog
CVE: CVE-2013-5093
Published: 2013-09-27
Description: The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/; http://secunia.com/advisories/54556; http://www.exploit-db.com/exploits/27752
CVE: CVE-2013-5472
Published: 2013-09-27
Description: The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1, and IOS XE 2.1 through 3.3, does not properly handle encapsulation of multicast NTP packets within MSDP SA messages, which allows remote attackers to cause a denial of service (device reload) by leveraging an MSDP peer relationship, aka Bug ID CSCuc81226.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ntp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ntp
CVE: CVE-2013-5473
Published: 2013-09-27
Description: Memory leak in Cisco IOS 12.2, 15.1, and 15.2; IOS XE 3.4.2S through 3.4.5S; and IOS XE 3.6.xS before 3.6.1S allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed IKEv1 packets, aka Bug ID CSCtx66011.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ike; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ike
CVE: CVE-2013-5474
Published: 2013-09-27
Description: Race condition in the IPv6 virtual fragmentation reassembly (VFR) implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.3 allows remote attackers to cause a denial of service (device reload or hang) via fragmented IPv6 packets, aka Bug ID CSCud64812.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ipv6vfr; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ipv6vfr
CVE: CVE-2013-5475
Published: 2013-09-27
Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.3, and IOS XE 2.1 through 3.9, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets that are processed locally by a (1) server or (2) relay agent, aka Bug ID CSCug31561.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-dhcp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-dhcp
CVE: CVE-2013-5476
Published: 2013-09-27
Description: The Zone-Based Firewall (ZFW) feature in Cisco IOS 15.1 through 15.2, when content filtering or HTTP ALG inspection is enabled, allows remote attackers to cause a denial of service (device reload or hang) via crafted IPv4 HTTP traffic, aka Bug ID CSCtx56174.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-cce; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-cce
CVE: CVE-2013-5477
Published: 2013-09-27
Description: The T1/E1 driver-queue functionality in Cisco IOS 12.2 and 15.0 through 15.3, when an HDLC32 driver is used, allows remote attackers to cause a denial of service (interface queue wedge) via bursty network traffic, aka Bug ID CSCub67465.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-wedge; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-wedge
CVE: CVE-2013-5478
Published: 2013-09-27
Description: Cisco IOS 15.0 through 15.3 and IOS XE 3.2 through 3.8, when a VRF interface exists, allows remote attackers to cause a denial of service (interface queue wedge) via crafted UDP RSVP packets, aka Bug ID CSCuf17023.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp
CVE: CVE-2013-5479
Published: 2013-09-27
Description: The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 through 15.3, when NAT is used, allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 DNS TCP stream, aka Bug ID CSCtn53730.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat
CVE: CVE-2013-5480
Published: 2013-09-27
Description: The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 through 15.3, when NAT is used, allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 DNS TCP stream, aka Bug ID CSCuf28733.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat
CVE: CVE-2013-5481
Published: 2013-09-27
Description: The PPTP implementation in Cisco IOS 12.2 and 15.0 through 15.3, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted TCP port-1723 packets, aka Bug ID CSCtq14817.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat
CVE: CVE-2013-5942
Published: 2013-09-27
Description: Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) storage.py, (3) render/datalib.py, and (4) whitelist/views.py, a different vulnerability than CVE-2013-5093.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/54556; https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst; http://secunia.com/advisories/54556
CVE: CVE-2013-5943
Published: 2013-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/54556; https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst; http://secunia.com/advisories/54556
CVE: CVE-2012-1313
Published: 2013-09-27
Description: The remote debug shell on the PALO adapter card in Cisco Unified Computing System (UCS) allows local users to gain privileges via malformed show-macstats parameters, aka Bug ID CSCub13772.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/97776; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-1313; http://www.securitytracker.com/id/1029103
CVE: CVE-2013-5403
Published: 2013-09-27
Description: Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC96174; http://www.ibm.com/support/docview.wss?uid=swg21651098; https://exchange.xforce.ibmcloud.com/vulnerabilities/87299
CVE: CVE-2013-5498
Published: 2013-09-27
Description: The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (ISM) in Cisco IOS XR allows remote attackers to cause a denial of service (module reset) via crafted packet streams, aka Bug ID CSCue91963.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/97777; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5498; http://tools.cisco.com/security/center/viewAlert.x?alertId=30994
CVE: CVE-2013-0598
Published: 2013-09-28
Description: Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM88185; http://www-01.ibm.com/support/docview.wss?uid=swg21648665; https://exchange.xforce.ibmcloud.com/vulnerabilities/83611
CVE: CVE-2013-5160
Published: 2013-09-28
Description: Passcode Lock in Apple iOS before 7.0.2 on iPhone devices allows physically proximate attackers to bypass an intended passcode requirement, and dial arbitrary telephone numbers, by making a series of taps of the emergency-call button to trigger a NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00009.html; http://support.apple.com/kb/HT5957; http://lists.apple.com/archives/security-announce/2013/Sep/msg00009.html
CVE: CVE-2013-5161
Published: 2013-09-28
Description: Passcode Lock in Apple iOS before 7.0.2 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement, and open the Camera app or read the list of all recently opened apps, by leveraging unspecified transition errors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00009.html; http://support.apple.com/kb/HT5957; http://lists.apple.com/archives/security-announce/2013/Sep/msg00009.html
CVE: CVE-2013-1921
Published: 2013-09-28
Description: PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2013-1207.html; http://rhn.redhat.com/errata/RHSA-2013-1208.html; http://rhn.redhat.com/errata/RHSA-2013-1209.html
CVE: CVE-2013-2068
Published: 2013-09-28
Description: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://rhn.redhat.com/errata/RHSA-2013-1206.html; http://www.exploit-db.com/exploits/30469; https://bugzilla.redhat.com/show_bug.cgi?id=960422
CVE: CVE-2013-4112
Published: 2013-09-28
Description: The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-1207.html; http://rhn.redhat.com/errata/RHSA-2013-1208.html; http://rhn.redhat.com/errata/RHSA-2013-1209.html
CVE: CVE-2013-4244
Published: 2013-09-28
Description: The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2452; http://rhn.redhat.com/errata/RHSA-2014-0223.html; https://bugzilla.redhat.com/show_bug.cgi?id=996468
CVE: CVE-2013-4276
Published: 2013-09-28
Description: Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718682; http://lists.opensuse.org/opensuse-updates/2013-10/msg00021.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00029.html
CVE: CVE-2013-5959
Published: 2013-09-28
Description: Blue Coat ProxySG before 6.2.14.1, 6.3.x, 6.4.x, and 6.5 before 6.5.2 allows remote attackers to cause a denial of service (memory consumption and dropped connections) via a recursive href in an HTML page, which triggers a large number of HTTP RW pipeline pre-fetch requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://osvdb.org/97767; http://secunia.com/advisories/54991; http://www.securitytracker.com/id/1029088
CVE: CVE-2013-3417
Published: 2013-09-30
Description: The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watch video feeds via a crafted URL, aka Bug ID CSCtg72262.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3417; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3417
CVE: CVE-2013-5504
Published: 2013-09-30
Description: Cross-site scripting (XSS) vulnerability in the Mobile Device Management (MDM) portal in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30266.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/97877; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5504; http://tools.cisco.com/security/center/viewAlert.x?alertId=31007
CVE: CVE-2013-5505
Published: 2013-09-30
Description: Cross-site scripting (XSS) vulnerability in an administration page in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/97875; http://secunia.com/advisories/54626; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5505
CVE: CVE-2013-5679
Published: 2013-09-30
Description: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
CVSS Score: 2.6 (LOW)
CWE: CWE-310
References: http://code.google.com/p/owasp-esapi-java/issues/detail?id=306; http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html; http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
CVE: CVE-2013-5960
Published: 2013-09-30
Description: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://code.google.com/p/owasp-esapi-java/issues/detail?id=306; http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html; http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
CVE: CVE-2013-1442
Published: 2013-09-30
Description: Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
CVSS Score: 1.2 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html; http://security.gentoo.org/glsa/glsa-201407-03.xml
CVE: CVE-2013-4136
Published: 2013-09-30
Description: ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2013-1136.html; http://www.openwall.com/lists/oss-security/2013/07/16/6; https://code.google.com/p/phusion-passenger/issues/detail?id=910