rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4227 
Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Mozilla
product: Persona
Published: 2020-02-18T14:08:31.000Z
CVE-2013-4228 
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
Problem types: description: Insecure Permissions
Affected products: vendor: n/a
product: Organic Groups (OG) module
Published: 2020-02-18T18:13:23.000Z
CVE-2013-4229 
Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated users with permissions to add pages to inject arbitrary web script or HTML via a title in the page settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-21T14:00:00.000Z
CVE-2013-4230 
The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrary submissions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-21T14:00:00.000Z
CVE-2013-4231 
Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c.  NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T15:00:00.000Z
CVE-2013-4232 
Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T19:00:00.000Z
CVE-2013-4233 
Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted P header in an ABC file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4234 
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4235 
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
Problem types: description: race conditions by copying and removing directory trees
Affected products: vendor: shadow
product: shadow
Published: 2019-12-03T00:00:00.000Z
CVE-2013-4236 
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response.  NOTE: this issue is due to an incomplete fix for CVE-2013-0167.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4237 
sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T22:00:00.000Z
CVE-2013-4238 
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-18T01:00:00.000Z
CVE-2013-4239 
The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T21:00:00.000Z
CVE-2013-4240 
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-02T14:00:00.000Z
CVE-2013-4241 
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
Problem types: description: Cross-Site Scripting
Affected products: vendor: HitMyServer
product: HMS Testimonials
Published: 2020-01-30T20:26:53.000Z
CVE-2013-4242 
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-4243 
Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T19:00:00.000Z
CVE-2013-4244 
The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-28T19:00:00.000Z
CVE-2013-4245 
Orca has arbitrary code execution due to insecure Python module load
Problem types: description: code execution due to insecure CWD Python module load
Affected products: vendor: Orca
product: Orca
Published: 2019-12-11T13:30:31.000Z
CVE-2013-4246 
libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2013-4247 
Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4248 
The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-18T01:00:00.000Z
CVE-2013-4249 
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T17:00:00.000Z
CVE-2013-4250 
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T14:00:00.000Z
CVE-2013-4251 
The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.
Problem types: description: /tmp and current directory issues
Affected products: vendor: SciPy
product: SciPy
Published: 2019-11-04T19:21:42.000Z
CVE-2013-4253 
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: n/a
product: Red Hat Openshift
Published: 2022-10-19T00:00:00.000Z
CVE-2013-4254 
The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-25T01:00:00.000Z
CVE-2013-4255 
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4256 
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-4258 
Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to syslog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-4259 
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4260 
lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4261 
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-29T22:00:00.000Z
CVE-2013-4262 
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file.  NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-2013-7393.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T19:00:00.000Z
CVE-2013-4263 
libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T17:00:00.000Z
CVE-2013-4264 
The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T17:00:00.000Z
CVE-2013-4265 
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T17:00:00.000Z
CVE-2013-4267 
Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php).
Problem types: description: Metacharacters
Affected products: vendor: n/a
product: Ajaxeplorer
Published: 2020-02-11T03:58:09.000Z
CVE-2013-4270 
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T18:00:00.000Z
CVE-2013-4271 
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T00:00:00.000Z
CVE-2013-4272 
The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging level is set to 5 or 6, logs the content of submitted forms, which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T15:00:00.000Z
CVE-2013-4273 
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was assigned for the View vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T18:00:00.000Z
CVE-2013-4274 
Cross-site scripting (XSS) vulnerability in the password_policy_admin_view function in password_policy.admin.inc in the Password Policy module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the admin/config/people/password_policy/add page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T15:00:00.000Z
CVE-2013-4275 
Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, and 7.x-5.x before 7.x-5.4 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the breadcrumb separator field.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Zen
product: Zen theme
Published: 2019-11-13T20:43:27.000Z
CVE-2013-4276 
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-28T19:00:00.000Z
CVE-2013-4277 
Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4278 
The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.  NOTE: this issue is due to an incomplete fix for CVE-2013-2256.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-4279 
imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2013-4280 
Insecure temporary file vulnerability in RedHat vsdm 4.9.6.
Problem types: description: /tmp file vulnerability issues
Affected products: vendor: RedHat
product: vdsm
Published: 2019-11-04T18:50:52.000Z
CVE-2013-4281 
In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with local access to the broker to read this file.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: n/a
product: Red Hat Openshift
Published: 2022-10-19T00:00:00.000Z
CVE-2013-4282 
Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-4283 
ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T19:00:00.000Z
CVE-2013-4284 
Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted Ajax update request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-4285 
A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-28T14:00:00.000Z
CVE-2013-4286 
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T11:00:00.000Z
CVE-2013-4287 
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4288 
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-4289 
Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigger a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T14:00:00.000Z
CVE-2013-4290 
Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opj_jp3d_compress.c, (2) bin/jp3d/convert.c, or (3) lib/openjp3d/event.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T14:00:00.000Z