deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2560
Published: 2013-03-15
Description: Directory traversal vulnerability in the web interface on Foscam devices with firmware before 11.37.2.49 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by discovering (1) web credentials or (2) Wi-Fi credentials.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0080.html; http://archives.neohapsis.com/archives/bugtraq/2013-03/0080.html
CVE: CVE-2013-2566
Published: 2013-03-15
Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html; http://cr.yp.to/talks/2013.03.12/slides.pdf; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2013-2371
Published: 2013-03-15
Description: The Web API in the Statistics Server in TIBCO Spotfire Statistics Services 3.3.x before 3.3.1, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 allows remote attackers to obtain sensitive information via an unspecified HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/spotfire-statistics-services-advisory-2013-03-12_tcm8-18479.txt; http://www.tibco.com/services/support/advisories/spotfire-advisory_20130313.jsp
CVE: CVE-2013-2372
Published: 2013-03-15
Description: Cross-site scripting (XSS) vulnerability in the Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/spotfire-web-player-advisory-2013-03-12_tcm8-18480.txt; http://www.tibco.com/services/support/advisories/spotfire-advisory_20130313.jsp
CVE: CVE-2013-2373
Published: 2013-03-15
Description: The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/spotfire-web-player-advisory-2013-03-12_tcm8-18480.txt; http://www.tibco.com/services/support/advisories/spotfire-advisory_20130313.jsp
CVE: CVE-2013-2492
Published: 2013-03-15
Description: Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00039.html; http://tracker.firebirdsql.org/browse/CORE-4058
CVE: CVE-2013-0913
Published: 2013-03-18
Description: Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://git.chromium.org/gitweb/?p=chromiumos/third_party/kernel.git%3Ba=commit%3Bh=c79efdf2b7f68f985922a8272d64269ecd490477; http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html; http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
CVE: CVE-2013-0915
Published: 2013-03-18
Description: The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an "overflow."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html; https://code.google.com/p/chromium/issues/detail?id=181083; http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html
CVE: CVE-2013-1495
Published: 2013-03-18
Description: asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://seclists.org/fulldisclosure/2013/Feb/159; http://www.mandriva.com/security/advisories?name=MDVSA-2013:150; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2013-0205
Published: 2013-03-19
Description: Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2013/01/21/5; https://drupal.org/node/1890212; https://drupal.org/node/1890216
CVE: CVE-2013-0206
Published: 2013-03-19
Description: Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.0 (MEDIUM)
References: http://drupal.org/node/1883976; http://drupal.org/node/1883978; http://drupalcode.org/project/live_css.git/commitdiff/cb7005f
CVE: CVE-2013-0207
Published: 2013-03-19
Description: Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupalcode.org/project/mark_complete.git/commitdiff/a18c7b2; http://www.openwall.com/lists/oss-security/2013/01/21/5; https://drupal.org/node/1890538
CVE: CVE-2013-0224
Published: 2013-03-19
Description: The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-16
References: http://www.openwall.com/lists/oss-security/2013/01/25/4; https://drupal.org/node/1895234; https://drupal.org/node/1896714
CVE: CVE-2013-0225
Published: 2013-03-19
Description: Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupalcode.org/project/user_relationships.git/commitdiff/17e94b9; http://drupalcode.org/project/user_relationships.git/commitdiff/b9a4739; http://www.openwall.com/lists/oss-security/2013/01/25/4
CVE: CVE-2013-0226
Published: 2013-03-19
Description: The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/01/25/4; https://drupal.org/node/1896752; http://www.openwall.com/lists/oss-security/2013/01/25/4
CVE: CVE-2013-0227
Published: 2013-03-19
Description: Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupalcode.org/project/search_api_sorts.git/commitdiff/f6cbf47; http://www.openwall.com/lists/oss-security/2013/01/25/4; https://drupal.org/node/1896756
CVE: CVE-2013-0251
Published: 2013-03-19
Description: Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699625; http://www.openwall.com/lists/oss-security/2013/02/04/3; http://www.openwall.com/lists/oss-security/2013/02/05/2
CVE: CVE-2013-0327
Published: 2013-03-19
Description: Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2013-0638.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb; http://www.openwall.com/lists/oss-security/2013/02/21/7
CVE: CVE-2013-0328
Published: 2013-03-19
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2013-0638.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb; http://www.openwall.com/lists/oss-security/2013/02/21/7
CVE: CVE-2013-0329
Published: 2013-03-19
Description: Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2013-0638.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb; http://www.openwall.com/lists/oss-security/2013/02/21/7
CVE: CVE-2013-0330
Published: 2013-03-19
Description: Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-0638.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb; http://www.openwall.com/lists/oss-security/2013/02/21/7
CVE: CVE-2013-0331
Published: 2013-03-19
Description: Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0638.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb; http://www.openwall.com/lists/oss-security/2013/02/21/7
CVE: CVE-2013-2263
Published: 2013-03-19
Description: Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/90905; http://secunia.com/advisories/52479; http://support.citrix.com/article/CTX136623
CVE: CVE-2013-1863
Published: 2013-03-19
Description: Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.samba.org/samba/ftp/patches/security/samba-4.0.3-CVE-2013-1863.patch; http://www.samba.org/samba/security/CVE-2013-1863; http://www.samba.org/samba/ftp/patches/security/samba-4.0.3-CVE-2013-1863.patch
CVE: CVE-2012-4223
Published: 2013-03-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-4224
Published: 2013-03-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2013-0505
Published: 2013-03-19
Description: IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1ID358571; http://www-01.ibm.com/support/docview.wss?uid=swg21631302; https://exchange.xforce.ibmcloud.com/vulnerabilities/82339
CVE: CVE-2013-0506
Published: 2013-03-19
Description: Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC90858; http://www-01.ibm.com/support/docview.wss?uid=swg21631302; https://exchange.xforce.ibmcloud.com/vulnerabilities/82341
CVE: CVE-2013-0717
Published: 2013-03-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jpn.nec.com/security-info/secinfo/nv13-005.html; http://jvn.jp/en/jp/JVN59503133/6443/index.html; http://jvn.jp/en/jp/JVN59503133/index.html
CVE: CVE-2013-1854
Published: 2013-03-19
Description: The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html
CVE: CVE-2013-1855
Published: 2013-03-19
Description: The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
CVE: CVE-2013-1856
Published: 2013-03-19
Description: The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html; http://support.apple.com/kb/HT5784
CVE: CVE-2013-1857
Published: 2013-03-19
Description: The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
CVE: CVE-2012-5938
Published: 2013-03-20
Description: The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21628844; https://exchange.xforce.ibmcloud.com/vulnerabilities/80493; http://www.ibm.com/support/docview.wss?uid=swg21628844
CVE: CVE-2013-0977
Published: 2013-03-20
Description: dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00005.html; http://support.apple.com/kb/HT5702
CVE: CVE-2013-0978
Published: 2013-03-20
Description: The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00005.html; http://support.apple.com/kb/HT5702
CVE: CVE-2013-0979
Published: 2013-03-20
Description: lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html; http://support.apple.com/kb/HT5704; http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html
CVE: CVE-2013-0980
Published: 2013-03-20
Description: The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html; http://support.apple.com/kb/HT5704; http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html
CVE: CVE-2013-0981
Published: 2013-03-20
Description: The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00005.html; http://support.apple.com/kb/HT5702
CVE: CVE-2013-0232
Published: 2013-03-20
Description: includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910; http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/; http://www.debian.org/security/2013/dsa-2640
CVE: CVE-2013-0332
Published: 2013-03-20
Description: Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700912; http://www.debian.org/security/2013/dsa-2640; http://www.openwall.com/lists/oss-security/2013/02/21/8
CVE: CVE-2013-1766
Published: 2013-03-20
Description: libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/52628; http://www.debian.org/security/2013/dsa-2650; http://www.securityfocus.com/bid/58178
CVE: CVE-2013-1842
Published: 2013-03-20
Description: SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html; http://osvdb.org/90925; http://secunia.com/advisories/52433
CVE: CVE-2013-1843
Published: 2013-03-20
Description: Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html; http://secunia.com/advisories/52433; http://secunia.com/advisories/52638
CVE: CVE-2013-1640
Published: 2013-03-20
Description: The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.
CVSS Score: 9.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html
CVE: CVE-2013-1652
Published: 2013-03-20
Description: Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html; http://rhn.redhat.com/errata/RHSA-2013-0710.html