rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-3658 
Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T10:00:00.000Z
CVE-2013-3659 
The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points, which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverage area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T19:00:00.000Z
CVE-2013-3660 
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-24T20:00:00.000Z
CVE-2013-3661 
The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-24T20:00:00.000Z
CVE-2013-3662 
Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T17:00:00.000Z
CVE-2013-3663 
Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed BMP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2013-3664 
Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662.  NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T17:00:00.000Z
CVE-2013-3665 
Unspecified vulnerability in Autodesk AutoCAD through 2014, AutoCAD LT through 2014, and DWG TrueView through 2014 allows remote attackers to execute arbitrary code via a crafted DWG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T14:00:00.000Z
CVE-2013-3666 
The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging mode, using Android Debug Bridge (adb) to establish a USB connection, dialing 3845#*973#, modifying the WLAN Test Wi-Fi Ping Test/User Command tcpdump command string, and pressing the CANCEL button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-29T10:00:00.000Z
CVE-2013-3667 
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T20:00:00.000Z
CVE-2013-3670 
The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data.  NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3671 
The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3672 
The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3673 
The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3674 
The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3675 
The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T01:00:00.000Z
CVE-2013-3678 
Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T16:00:00.000Z
CVE-2013-3684 
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-11T17:48:40.000Z
CVE-2013-3685 
A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condition in the spritebud daemon, which could let a local malicious user obtain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T15:41:42.000Z
CVE-2013-3686 
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T21:00:00.000Z
CVE-2013-3687 
AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by reading an unspecified backup file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T21:00:00.000Z
CVE-2013-3688 
The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T19:00:00.000Z
CVE-2013-3689 
Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.0.6.16C1 and earlier, do not properly restrict access to configfile.dump, which allow remote attackers to obtain sensitive information (user names, passwords, and configurations) via a get action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T23:00:00.000Z
CVE-2013-3690 
Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T19:00:00.000Z
CVE-2013-3691 
AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T18:22:22.000Z
CVE-2013-3692 
BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass intended access restrictions by leveraging a user's BlackBerry Protect password-reset request and a user's installation of a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-13T10:00:00.000Z
CVE-2013-3693 
The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to upload and execute arbitrary packages via a request to port 1098.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-3694 
BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T02:00:00.000Z
CVE-2013-3697 
Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003 and the NCPL.SYS kernel driver in Novell Client 2 SP2 on Windows Vista and Windows Server 2008 and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 might allow local users to gain privileges via a crafted 0x1439EB IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-3703 No write permission check in change_role command
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: openSUSE
product: Open Build Service
Published: 2018-06-08T17:00:00.000Z
CVE-2013-3704 
The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a more-trustworthy key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-3705 
The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-22T15:00:00.000Z
CVE-2013-3706 
Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname, aka ZDI-CAN-1595.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-06T11:00:00.000Z
CVE-2013-3707 
The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection, which allows remote attackers to cause a denial of service (service crash) by establishing many TCP connections to port 8009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-01T17:00:00.000Z
CVE-2013-3708 
The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-01T02:00:00.000Z
CVE-2013-3709 
WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T23:00:00.000Z
CVE-2013-3710 
SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-10T15:00:00.000Z
CVE-2013-3712 
SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has unspecified impact and vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T15:00:00.000Z
CVE-2013-3713 
The image creation configuration in aaa_base before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-11T01:00:00.000Z
CVE-2013-3718 
evince is missing a check on number of pages which can lead to a segmentation fault
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-01T12:24:33.000Z
CVE-2013-3719 
Cross-site scripting (XSS) vulnerability in the aiContactSafe component before 2.0.21 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-31T10:00:00.000Z
CVE-2013-3720 
Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wp_post_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-31T10:00:00.000Z
CVE-2013-3721 
SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-31T10:00:00.000Z
CVE-2013-3722 
A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T16:10:11.000Z
CVE-2013-3724 
The mk_request_header_process function in mk_request.c in Monkey 1.1.1 allows remote attackers to cause a denial of service (thread crash and service outage) via a '\0' character in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T21:00:00.000Z
CVE-2013-3725 
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T18:05:38.000Z
CVE-2013-3727 
SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-13T14:00:00.000Z
CVE-2013-3728 
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-13T14:00:00.000Z
CVE-2013-3729 
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-13T14:00:00.000Z
CVE-2013-3734 
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code.  NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T15:00:00.000Z
CVE-2013-3735 
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment.  NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-31T21:00:00.000Z
CVE-2013-3736 
Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-3737 
The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T02:00:00.000Z
CVE-2013-3738 
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T15:54:11.000Z
CVE-2013-3739 
Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the mapname parameter in a show_config action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z
CVE-2013-3742 
Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-04T10:00:00.000Z
CVE-2013-3743 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-18T22:00:00.000Z
CVE-2013-3744 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2400.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-18T22:00:00.000Z
CVE-2013-3745 
Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Libraries/Libc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-17T10:00:00.000Z
CVE-2013-3746 
Unspecified vulnerability in the Solaris Cluster component in Oracle and Sun Systems Products Suite 3.2, 3.3, and 4 prior to 4.1 SRU 3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Zone Cluster Infrastructure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-17T10:00:00.000Z
CVE-2013-3747 
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Client System Analyzer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-17T10:00:00.000Z
CVE-2013-3748 
Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect availability via vectors related to Driver/IDM (iSCSI Data Mover).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-17T10:00:00.000Z