rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4163 
The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-28T18:00:00.000Z
CVE-2013-4164 
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T19:00:00.000Z
CVE-2013-4165 
The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-01T16:00:00.000Z
CVE-2013-4166 
The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.
Problem types: description: Other
Affected products: vendor: GNOME
product: Evolution
vendor: GNOME
product: Evolution Data Server
Published: 2020-02-06T14:29:39.000Z
CVE-2013-4167 
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4168 
Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.
Problem types: description: and end time fields not filtered
Affected products: vendor: SmokePing
product: SmokePing
Published: 2019-11-01T19:12:30.000Z
CVE-2013-4169 
GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T19:00:00.000Z
CVE-2013-4170 
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: ember-source
Published: 2022-06-30T12:38:42.000Z
CVE-2013-4171 
Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4172 
The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-4173 
Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4174 
Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) flash_uri, (2) flash_width, or (3) flash_height in the scald_flash_scald_prerender function in providers/scald_flash/scald_flash.module; or the (4) caption in the scald_image_scald_prerender function in providers/scald_image/scald_image.module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4175 
MySecureShell 1.31 has a Local Denial of Service Vulnerability
Problem types: description: denial of service
Affected products: vendor: MySecureShell
product: MySecureShell
Published: 2020-01-23T14:17:42.000Z
CVE-2013-4176 
mysecureshell 1.31: Local Information Disclosure Vulnerability
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: mysecureshell
product: mysecureshell
Published: 2020-01-23T14:15:45.000Z
CVE-2013-4177 
The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2013-4178 
The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2013-4179 
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4180 
The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4181 
Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4182 
app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4183 
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4184 
Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
Problem types: description: attacks
Affected products: vendor: libdata-uuid-perl
product: libdata-uuid-perl
Published: 2019-12-10T00:00:00.000Z
CVE-2013-4185 
Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-29T22:00:00.000Z
CVE-2013-4187 
The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to access content to read a link or alias to a restricted node.
Problem types: description: Insecure Permissions
Affected products: vendor: Flippy
product: Flippy
Published: 2020-01-30T20:40:23.000Z
CVE-2013-4188 
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4189 
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4190 
Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4191 
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4192 
sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4193 
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4194 
The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4195 
Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4196 
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4197 
member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4198 
mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4199 
(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4200 
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property,  redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T16:00:00.000Z
CVE-2013-4201 
Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T19:00:00.000Z
CVE-2013-4202 
The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4203 
The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4204 
Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4205 
Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4206 
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) and possibly trigger memory corruption or code execution via a crafted DSA signature, which is not properly handled when performing certain bit-shifting operations during modular multiplication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4207 
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4208 
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4209 
Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T19:00:00.000Z
CVE-2013-4210 
The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T17:00:00.000Z
CVE-2013-4211 
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code
Problem types: description: backdoor
Affected products: vendor: OpenX
product: Ad Server
Published: 2020-02-14T19:59:06.000Z
CVE-2013-4212 
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4213 
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-16T16:00:00.000Z
CVE-2013-4214 
rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T17:00:00.000Z
CVE-2013-4215 
The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-4216 
The Trace_OpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses world-writable permissions for wimaxd.log, which allows local users to cause a denial of service (data corruption) by modifying this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4217 
The OSAL_Crypt_SetEncryptedPassword function in InfraStack/OSDependent/Linux/OSAL/Services/wimax_osal_crypt_services.c in the OSAL crypt module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices logs a cleartext password during certain attempts to set a password, which allows local users to obtain sensitive information by reading a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4218 
The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses the same RSA private key in supplicant_key.pem on all systems, which allows local users to obtain sensitive information via unspecified decryption operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4219 
Multiple integer overflows in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices allow remote attackers to cause a denial of service (component crash) or possibly execute arbitrary code via an L5 connection with a crafted PDU value that triggers a heap-based buffer overflow within (1) L5SocketsDispatcher.c or (2) L5Connector.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4220 
The bad_mode function in arch/arm64/kernel/traps.c in the Linux kernel before 3.9.5 on the ARM64 platform allows local users to cause a denial of service (system crash) via vectors involving an attempted register access that triggers an unexpected value in the Exception Syndrome Register (ESR).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4221 
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T00:00:00.000Z
CVE-2013-4222 
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T20:00:00.000Z
CVE-2013-4223 
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T14:00:00.000Z
CVE-2013-4225 
The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.
Problem types: description: Insecure Permissions
Affected products: vendor: RESTful Web Services
product: RESTful Web Services
Published: 2020-02-11T20:19:56.000Z
CVE-2013-4226 
The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser.
Problem types: description: Path Disclosure
Affected products: vendor: n/a
product: Authenticated User Page Caching (Authcache) module
Published: 2020-02-18T18:19:48.000Z