rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-2152 
Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain privileges via a crafted application in an unspecified folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z
CVE-2013-2153 
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2154 
Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions, probably related to the DSIGReference::getURIBaseTXFM function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2155 
Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2156 
Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PrefixList attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2157 
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2158 
Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-01T21:00:00.000Z
CVE-2013-2159 
Monkey HTTP Daemon: broken user name authentication
Problem types: description: broken authentication
Affected products: vendor: monkey
product: monkey
Published: 2019-12-10T14:13:29.000Z
CVE-2013-2160 
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-2161 
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2162 
Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux creates a configuration file with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T00:00:00.000Z
CVE-2013-2163 
Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the file size in the Range HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2013-2164 
The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-04T21:00:00.000Z
CVE-2013-2165 
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-22T19:00:00.000Z
CVE-2013-2166 
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
Problem types: description: memcache encryption bypass
Affected products: vendor: python-keystoneclient
product: python-keystoneclient
Published: 2019-12-10T14:19:56.000Z
CVE-2013-2167 
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
Problem types: description: memcache signing bypass
Affected products: vendor: python-keystoneclient
product: python-keystoneclient
Published: 2019-12-10T14:22:03.000Z
CVE-2013-2168 
The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-03T18:00:00.000Z
CVE-2013-2171 
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-02T01:00:00.000Z
CVE-2013-2172 
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2173 
wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T10:00:00.000Z
CVE-2013-2174 
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2175 
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T00:00:00.000Z
CVE-2013-2176 
Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T17:00:00.000Z
CVE-2013-2177 
Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity bundle label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T18:00:00.000Z
CVE-2013-2178 
The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block arbitrary IP addresses via certain messages in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T17:18:00.000Z
CVE-2013-2179 
X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-27T01:00:00.000Z
CVE-2013-2181 
Cross-site scripting (XSS) vulnerability in the Directory Listing plugin in Monkey HTTP Daemon (monkeyd) 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-29T21:00:00.000Z
CVE-2013-2182 
The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restrictions via a crafted URI, as demonstrated by an encoded forward slash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2013-2183 
Monkey HTTP Daemon has local security bypass
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: monkey
product: monkey
Published: 2019-12-10T14:29:44.000Z
CVE-2013-2184 
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2013-2185 
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T16:00:00.000Z
CVE-2013-2186 
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T21:00:00.000Z
CVE-2013-2187 
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2013-2188 
A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle failure to obtain write permissions, which allows local users to cause a denial of service (system crash) by leveraging access to a filesystem that is mounted read-only.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T10:00:00.000Z
CVE-2013-2189 
Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2190 
The translate_hierarchy_event function in x11/clutter-device-manager-xi2.c in Clutter, when resuming the system, does not properly handle XIQueryDevice errors when a device has "disappeared," which causes the gnome-shell to crash and allows physically proximate attackers to access the previous gnome-shell session via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-2191 
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-08T00:00:00.000Z
CVE-2013-2192 
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2013-2193 
Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2013-2194 
Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-2195 
The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-2196 
Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-2197 
The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal, when using the login delay option, allows remote attackers to cause a denial of service (CPU consumption) via a large number of failed login attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T15:00:00.000Z
CVE-2013-2198 
The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username.
Problem types: description: Weak Authentication
Affected products: vendor: Login Security
product: Login Security
Published: 2020-01-30T20:35:21.000Z
CVE-2013-2199 
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2200 
WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2201 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2202 
WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2203 
WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2204 
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2205 
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-2206 
The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-04T21:00:00.000Z
CVE-2013-2207 
pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T22:00:00.000Z
CVE-2013-2208 
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-2209 
Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2210 
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T22:00:00.000Z
CVE-2013-2211 
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T17:00:00.000Z
CVE-2013-2212 
The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T17:00:00.000Z
CVE-2013-2213 
The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output.
Problem types: description: Insufficient Random Number Generation
Affected products: vendor: n/a
product: KDE Paste Applet
Published: 2020-02-11T19:19:46.000Z
CVE-2013-2214 
status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi.  NOTE: this behavior is by design in most 3.x versions, but the upstream vendor "decided to change it for Nagios 4" and 3.5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T23:00:00.000Z
CVE-2013-2217 
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-23T20:00:00.000Z