deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1146
Published: 2013-03-28
Description: The Smart Install client functionality in Cisco IOS 12.2 and 15.0 through 15.3 on Catalyst switches allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in Smart Install packets, aka Bug ID CSCub55790.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-smartinstall; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-smartinstall
CVE: CVE-2013-1147
Published: 2013-03-28
Description: The Protocol Translation (PT) functionality in Cisco IOS 12.3 through 12.4 and 15.0 through 15.3, when one-step port-23 translation or a Telnet-to-PAD ruleset is configured, does not properly validate TCP connection information, which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a PT resource, aka Bug ID CSCtz35999.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-pt; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-pt
CVE: CVE-2013-1148
Published: 2013-03-28
Description: The General Responder implementation in the IP Service Level Agreement (SLA) feature in Cisco IOS 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S allows remote attackers to cause a denial of service (device reload) via crafted (1) IPv4 or (2) IPv6 IP SLA packets on UDP port 1167, aka Bug ID CSCuc72594.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ipsla; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ipsla
CVE: CVE-2013-1492
Published: 2013-03-28
Description: Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html; http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-30.html; http://secunia.com/advisories/52445
CVE: CVE-2013-1747
Published: 2013-03-28
Description: channel.c in ngIRCd 20 and 20.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a KICK command for a user who is not on the associated channel.
CVSS Score: 5.0 (MEDIUM)
References: http://arthur.barton.de/pipermail/ngircd-ml/2013-February/000623.html; http://arthur.barton.de/pipermail/ngircd-ml/2013-February/000625.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101706.html
CVE: CVE-2013-1861
Published: 2013-03-28
Description: MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.askmonty.org/pipermail/commits/2013-March/004371.html; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2013-10/msg00001.html
CVE: CVE-2013-2290
Published: 2013-03-28
Description: Cross-site scripting (XSS) vulnerability in the dashboard of the ArubaOS Administration WebUI in Aruba Networks ArubaOS 6.2.x before 6.2.0.3, 6.1.3.x before 6.1.3.7, 6.1.x-FIPS before 6.1.4.3-FIPS, and 6.1.x-AirGroup before 6.1.3.6-AirGroup, as used by Mobility Controller, allows remote wireless access points to inject arbitrary web script or HTML via a crafted SSID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/91485; http://secunia.com/advisories/52690; http://www.arubanetworks.com/support/alerts/aid-042213.asc
CVE: CVE-2013-2690
Published: 2013-03-28
Description: SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0134.html; http://osvdb.org/91693; http://osvdb.org/ref/91/synconnect.txt
CVE: CVE-2012-6534
Published: 2013-03-29
Description: Novell Sentinel Log Manager before 1.2.0.3 allows remote attackers to create data retention policies via a crafted text/x-gwt-rpc request to novelllogmanager/datastorageservice.rpc, and allows remote authenticated Report Administrators to create data retention policies via a search-results "Save Query As" "Save As Retention Policy" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2012/Oct/25; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5150932.html; https://bugzilla.novell.com/show_bug.cgi?id=771634
CVE: CVE-2013-0452
Published: 2013-03-29
Description: Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack the authentication of arbitrary users via a web site that contains crafted Flash Action Message Format (AMF) messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV38145; http://www-01.ibm.com/support/docview.wss?uid=swg21631350; https://exchange.xforce.ibmcloud.com/vulnerabilities/80968
CVE: CVE-2013-0473
Published: 2013-03-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow remote attackers to inject arbitrary web script or HTML via a crafted report.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; http://www-01.ibm.com/support/docview.wss?uid=swg21631304; https://exchange.xforce.ibmcloud.com/vulnerabilities/81337
CVE: CVE-2013-0474
Published: 2013-03-29
Description: The Manual Explore browser plug-in in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to discover test Platform Authentication credentials via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; http://www-01.ibm.com/support/docview.wss?uid=swg21631304; https://exchange.xforce.ibmcloud.com/vulnerabilities/81338
CVE: CVE-2013-0510
Published: 2013-03-29
Description: IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; https://exchange.xforce.ibmcloud.com/vulnerabilities/82592; http://www-01.ibm.com/support/docview.wss?uid=swg21626264
CVE: CVE-2013-0511
Published: 2013-03-29
Description: Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; https://exchange.xforce.ibmcloud.com/vulnerabilities/82344; http://www-01.ibm.com/support/docview.wss?uid=swg21626264
CVE: CVE-2013-0512
Published: 2013-03-29
Description: Stack-based buffer overflow in the Manual Explore browser plug-in for Firefox in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to cause a denial of service (plug-in crash) via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; http://www-01.ibm.com/support/docview.wss?uid=swg21631304; https://exchange.xforce.ibmcloud.com/vulnerabilities/82593
CVE: CVE-2013-0513
Published: 2013-03-29
Description: IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create a service that lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program, related to an "Unquoted Service Path Enumeration" vulnerability.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; http://www-01.ibm.com/support/docview.wss?uid=swg21631304; https://exchange.xforce.ibmcloud.com/vulnerabilities/82594
CVE: CVE-2013-0532
Published: 2013-03-29
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that cause a denial of service via malformed HTTP data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21626264; http://www-01.ibm.com/support/docview.wss?uid=swg21631304; https://exchange.xforce.ibmcloud.com/vulnerabilities/82595
CVE: CVE-2013-1079
Published: 2013-03-29
Description: Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.novell.com/support/kb/doc.php?id=7011811; http://www.zerodayinitiative.com/advisories/ZDI-13-048/; http://www.novell.com/support/kb/doc.php?id=7011811
CVE: CVE-2013-1080
Published: 2013-03-29
Description: The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/24938; http://www.novell.com/support/kb/doc.php?id=7011812; http://www.novell.com/support/kb/doc.php?id=7012027
CVE: CVE-2013-1082
Published: 2013-03-29
Description: Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.novell.com/support/kb/doc.php?id=7011896; http://www.novell.com/support/kb/doc.php?id=7011896
CVE: CVE-2013-1083
Published: 2013-03-29
Description: Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager (aka IDM) Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://download.novell.com/Download?buildid=nbGXg-msbmw~; https://bugzilla.novell.com/show_bug.cgi?id=807193; http://download.novell.com/Download?buildid=nbGXg-msbmw~
CVE: CVE-2013-1085
Published: 2013-03-29
Description: Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier, and Novell Messenger 2.1.x and 2.2.x before 2.2.2, allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/kb/doc.php?id=7011935; http://www.zerodayinitiative.com/advisories/ZDI-13-036/; https://bugzilla.novell.com/show_bug.cgi?id=777352
CVE: CVE-2013-1299
Published: 2013-03-29
Description: Microsoft Windows Modern Mail allows remote attackers to spoof link targets via a crafted HTML e-mail message.
CVSS Score: 5.8 (MEDIUM)
References: http://support.microsoft.com/kb/2832006; http://technet.microsoft.com/security/advisory/2819682; http://support.microsoft.com/kb/2832006
CVE: CVE-2013-2301
Published: 2013-03-29
Description: The OMRON OpenWnn application before 1.3.6 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN01167429/995309/index.html; http://jvn.jp/en/jp/JVN01167429/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000025
CVE: CVE-2013-0130
Published: 2013-03-29
Description: Multiple buffer overflows in Core FTP before 2.2 build 1769 allow remote FTP servers to execute arbitrary code or cause a denial of service (application crash) via a long directory name in a (1) DELE, (2) LIST, or (3) VIEW command.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://www.coreftp.com/forums/viewtopic.php?t=222102; http://www.kb.cert.org/vuls/id/370868; http://www.coreftp.com/forums/viewtopic.php?t=222102
CVE: CVE-2013-2264
Published: 2013-04-01
Description: The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://downloads.asterisk.org/pub/security/AST-2013-003.html; https://issues.asterisk.org/jira/browse/ASTERISK-21013; http://downloads.asterisk.org/pub/security/AST-2013-003.html
CVE: CVE-2013-2685
Published: 2013-04-01
Description: Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2013-001.html; https://issues.asterisk.org/jira/browse/ASTERISK-20901; http://downloads.asterisk.org/pub/security/AST-2013-001.html
CVE: CVE-2013-2686
Published: 2013-04-01
Description: main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2013-002.html; http://telussecuritylabs.com/threats/show/TSL20130327-01; https://issues.asterisk.org/jira/browse/ASTERISK-20967
CVE: CVE-2013-0659
Published: 2013-04-01
Description: The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.
CVSS Score: 10.0 (HIGH)
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-084-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-628113.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-084-01.pdf
CVE: CVE-2012-4861
Published: 2013-04-01
Description: The web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7 and 10.1 through 10.1.0.4 allows remote authenticated users to list directories via a direct request for a directory URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21632383; https://exchange.xforce.ibmcloud.com/vulnerabilities/79844; http://www-01.ibm.com/support/docview.wss?uid=swg21632383
CVE: CVE-2013-0502
Published: 2013-04-01
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR45274; http://www-01.ibm.com/support/docview.wss?uid=swg21632556; https://exchange.xforce.ibmcloud.com/vulnerabilities/82233
CVE: CVE-2013-1163
Published: 2013-04-01
Description: Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1163; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1163
CVE: CVE-2013-1171
Published: 2013-04-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCue14517, CSCue38914, CSCue38884, CSCue38882, CSCue38881, CSCue38872, CSCue38868, CSCue38866, CSCue38853, and CSCue14540.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1171; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1171
CVE: CVE-2012-6550
Published: 2013-04-02
Description: Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Feb/103; https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-114; https://github.com/jonrohan/ZeroClipboard/commit/51b67b6d696f62aaf003210c[PII_REDACTED]2c4913
CVE: CVE-2013-0240
Published: 2013-04-02
Description: Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html; http://secunia.com/advisories/51976; http://secunia.com/advisories/52791
CVE: CVE-2013-1799
Published: 2013-04-02
Description: Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.  NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html; http://secunia.com/advisories/51976; http://secunia.com/advisories/52791
CVE: CVE-2013-1808
Published: 2013-04-02
Description: Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Apr/87; http://seclists.org/fulldisclosure/2013/Apr/88; http://seclists.org/fulldisclosure/2013/Feb/103
CVE: CVE-2013-2741
Published: 2013-04-02
Description: importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html; http://packetstormsecurity.com/files/120923; http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html
CVE: CVE-2013-2742
Published: 2013-04-02
Description: importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html; http://packetstormsecurity.com/files/120923; http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html
CVE: CVE-2013-2743
Published: 2013-04-02
Description: importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html; http://packetstormsecurity.com/files/120923; http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html
CVE: CVE-2013-2744
Published: 2013-04-02
Description: importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html; http://packetstormsecurity.com/files/120923; http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html
CVE: CVE-2012-6119
Published: 2013-04-02
Description: Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0686.html; http://secunia.com/advisories/52774; http://www.osvdb.org/91719
CVE: CVE-2013-1823
Published: 2013-04-02
Description: Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0686.html; http://secunia.com/advisories/52774; http://www.osvdb.org/91718
CVE: CVE-2012-1038
Published: 2013-04-03
Description: Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2012-06-611&viewMode=view; http://www.secureworks.com/advisories/swrx-2012-004/SWRX-2012-004.pdf; http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2012-004/