rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-1900 
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T17:00:00.000Z
CVE-2013-1901 
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T17:00:00.000Z
CVE-2013-1902 
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T17:00:00.000Z
CVE-2013-1903 
PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T17:00:00.000Z
CVE-2013-1904 
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-08T00:00:00.000Z
CVE-2013-1905 
Cross-site scripting (XSS) vulnerability in the Zero Point theme 7.x-1.x before 7.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T23:00:00.000Z
CVE-2013-1906 
Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-24T16:13:00.000Z
CVE-2013-1907 
The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-1908 
The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-1909 
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-1910 
yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.
Problem types: description: Denial of Service - Malformed Input
Affected products: vendor: yum
product: yum
Published: 2019-10-31T18:36:26.000Z
CVE-2013-1911 
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-03T00:00:00.000Z
CVE-2013-1912 
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T15:00:00.000Z
CVE-2013-1913 
Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries value in an X Window System (XWD) image dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T18:00:00.000Z
CVE-2013-1914 
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T22:00:00.000Z
CVE-2013-1915 
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-1916 
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: WordPress Plugin User Photo
Published: 2022-06-24T15:00:17.000Z
CVE-2013-1917 
Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1918 
Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1919 
Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1920 
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-12T22:00:00.000Z
CVE-2013-1921 
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-28T19:00:00.000Z
CVE-2013-1922 
qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1923 
rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z
CVE-2013-1924 
Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2
Problem types: description: authentication error
Affected products: vendor: Commerce Skrill
product: Commerce Skrill
Published: 2020-02-12T15:39:09.000Z
CVE-2013-1925 
The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-1926 
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T22:00:00.000Z
CVE-2013-1927 
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T22:00:00.000Z
CVE-2013-1928 
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T10:00:00.000Z
CVE-2013-1929 
Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-1930 
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
Problem types: description: Other
Affected products: vendor: mantisBT
product: mantisBT
Published: 2019-10-31T19:05:01.000Z
CVE-2013-1931 
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
Problem types: description: Cross-Site Scripting
Affected products: vendor: mantisBT
product: mantisBT
Published: 2019-10-31T19:05:05.000Z
CVE-2013-1932 
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
Problem types: description: Cross-Site Scripting
Affected products: vendor: mantisBT
product: mantisBT
Published: 2019-10-31T19:05:12.000Z
CVE-2013-1933 
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-1934 
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
Problem types: description: Cross-Site Scripting
Affected products: vendor: mantisBT
product: mantisBT
Published: 2019-10-31T19:05:16.000Z
CVE-2013-1935 
A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T10:00:00.000Z
CVE-2013-1937 
Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-16T10:00:00.000Z
CVE-2013-1938 
Zimbra 2013 has XSS in aspell.php
Problem types: description: XSS
Affected products: vendor: Zimbra
product: Zimbra
Published: 2020-02-12T15:02:24.000Z
CVE-2013-1939 
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1940 
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1941 
The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-04T14:00:00.000Z
CVE-2013-1942 
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-15T17:00:00.000Z
CVE-2013-1943 
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T10:00:00.000Z
CVE-2013-1944 
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T22:00:00.000Z
CVE-2013-1945 
ruby193 uses an insecure LD_LIBRARY_PATH setting.
Problem types: description: Unknown
Affected products: vendor: ruby193
product: ruby193
Published: 2019-10-31T19:24:57.000Z
CVE-2013-1946 
The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0-alpha5 for Drupal, when page caching is enabled and anonymous users are assigned RESTWS permissions, allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type, which can "interfere with Drupal's page cache."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-06T16:00:00.000Z
CVE-2013-1947 
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-1948 
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-1949 
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-1950 
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-09T17:00:00.000Z
CVE-2013-1951 
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ikimedia Foundation
product: MediaWiki
Published: 2019-10-31T19:33:37.000Z
CVE-2013-1952 
Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1953 
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T11:00:00.000Z
CVE-2013-1954 
The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T19:00:00.000Z
CVE-2013-1955 
Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T01:00:00.000Z
CVE-2013-1956 
The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-24T19:00:00.000Z
CVE-2013-1957 
The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-24T19:00:00.000Z
CVE-2013-1958 
The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-24T19:00:00.000Z
CVE-2013-1959 
kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-03T10:00:00.000Z
CVE-2013-1960 
Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-03T18:00:00.000Z
CVE-2013-1961 
Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-03T18:00:00.000Z
CVE-2013-1962 
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-29T00:00:00.000Z
CVE-2013-1963 
The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z