rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-7336 
The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-07T10:00:00.000Z
CVE-2013-7338 
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2013-7339 
The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-24T10:00:00.000Z
CVE-2013-7340 
VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2013-7341 
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-22T01:00:00.000Z
CVE-2013-7342 
Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-22T01:00:00.000Z
CVE-2013-7343 
Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-22T01:00:00.000Z
CVE-2013-7344 
Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-23T15:00:00.000Z
CVE-2013-7345 
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-23T15:00:00.000Z
CVE-2013-7346 
Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-27T16:00:00.000Z
CVE-2013-7347 
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T00:00:00.000Z
CVE-2013-7348 
Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2013-7349 
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter to news/send.php, (2) thread_id parameter to posts/edit.php, or (3) user_email parameter to users/password.php or (4) users/register.php.  NOTE: these issues were SPLIT from CVE-2013-5640 due to differences in researchers and disclosure dates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T00:00:00.000Z
CVE-2013-7350 
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x before R75.20.4 and 600 and 1100 appliances R75.20.x before R75.20.42 have unknown impact and attack vectors related to "important security fixes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2013-7351 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS, (2) showATOM, or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Shaarli
product: Shaarli
Published: 2020-01-02T19:42:16.000Z
CVE-2013-7352 
Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-2945.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-02T18:00:00.000Z
CVE-2013-7353 
Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2013-7354 
Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2013-7355 
SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7356 
Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7357 
Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7358 
Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7359 
Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, related to an "internal port scanning" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7360 
Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7361 
Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7362 
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7363 
Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications, and install or remove applications via vectors involving the P4 protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7364 
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7365 
Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7366 
The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7367 
SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T15:00:00.000Z
CVE-2013-7368 
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gnew_template parameter to (1) users/profile.php, (2) articles/index.php, or (3) admin/polls.php; (4) category_id parameter to news/submit.php; news_id parameter to (5) news/send.php or (6) comments/add.php; or (7) post_subject or (8) thread_id parameter to posts/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T17:00:00.000Z
CVE-2013-7369 
SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus for Windows Servers 9.00 before HF09, Anti-Virus for Citrix Servers 9.00 before HF09, and F-Secure Email and Server Security and F-Secure Server Security 9.20 before HF01 allows remote attackers to execute arbitrary SQL commands via unknown vectors, related to GetCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T14:00:00.000Z
CVE-2013-7370 
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
Problem types: description: in the Sencha Labs Connect middleware
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T13:55:37.000Z
CVE-2013-7371 
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
Problem types: description: in the Sencha Labs Connect middleware
Affected products: vendor: node-connect
product: node-connect
Published: 2019-12-11T14:04:00.000Z
CVE-2013-7372 
The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T20:00:00.000Z
CVE-2013-7373 
Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T20:00:00.000Z
CVE-2013-7374 
The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10.20131023.2-0ubuntu1.1 does not properly restrict access to Evolution, which allows local users to bypass the greeter screen restrictions by clicking the date.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-01T14:00:00.000Z
CVE-2013-7375 
SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-7376 
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-3514.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-7377 
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T18:00:00.000Z
CVE-2013-7378 
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T13:59:50.000Z
CVE-2013-7379 
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows remote attackers to bypass authentication via a string in the access-key header that partially matches config.master.api.access_key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T15:00:00.000Z
CVE-2013-7380 
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T13:15:24.000Z
CVE-2013-7381 
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T14:25:23.000Z
CVE-2013-7382 
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-17T19:00:00.000Z
CVE-2013-7383 
x2gocleansessions in X2Go Server before 4.0.0.8 and 4.0.1.x before 4.0.1.10 allows remote authenticated users to gain privileges via unspecified vectors, possibly related to backticks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T14:00:00.000Z
CVE-2013-7384 
UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors, related to SSL.  NOTE: this issue was SPLIT from CVE-2013-6413 per ADT2 due to different vulnerability types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-7385 
LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7033.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-7386 
Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-7387 
Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-7388 
Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP).  NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T17:00:00.000Z
CVE-2013-7389 
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-07T14:00:00.000Z
CVE-2013-7390 
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T17:33:26.000Z
CVE-2013-7391 
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3) footer of a View.  NOTE: this identifier was SPLIT from CVE-2013-4273 per ADT5 due to different researcher organizations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T18:00:00.000Z
CVE-2013-7392 
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2013-7393 
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used.  NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T19:00:00.000Z
CVE-2013-7394 
The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string.  NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2013-7395 
ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-12T16:00:00.000Z
CVE-2013-7397 
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-24T16:00:00.000Z
CVE-2013-7398 
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-24T16:00:00.000Z
CVE-2013-7400 
The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T15:00:00.000Z
CVE-2013-7401 
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T20:00:00.000Z
CVE-2013-7402 
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T19:00:00.000Z