rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-1373 
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, and CVE-2013-1372.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2013-1374 
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0644 and CVE-2013-0649.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2013-1375 
Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-13T10:00:00.000Z
CVE-2013-1376 
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T15:00:00.000Z
CVE-2013-1377 
Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T01:00:00.000Z
CVE-2013-1378 
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1379 
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1380 
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1378.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1383 
Buffer overflow in Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1384 
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1386.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1385 
Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1386 
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1384.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1387 
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1388 
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-10T01:00:00.000Z
CVE-2013-1389 
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-16T10:00:00.000Z
CVE-2013-1391 
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-30T20:36:40.000Z
CVE-2013-1393 
Cross-site scripting (XSS) vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T21:00:00.000Z
CVE-2013-1397 
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-1398 
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1399 
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1400 
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T20:19:32.000Z
CVE-2013-1401 
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T20:48:39.000Z
CVE-2013-1402 
DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-14T22:00:00.000Z
CVE-2013-1405 
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-15T11:00:00.000Z
CVE-2013-1406 
The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-11T22:00:00.000Z
CVE-2013-1407 
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T14:00:00.000Z
CVE-2013-1408 
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-24T14:00:00.000Z
CVE-2013-1409 
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2013-1410 
Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T14:57:28.000Z
CVE-2013-1412 
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-1413 
Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-11T17:00:00.000Z
CVE-2013-1414 
Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T17:00:00.000Z
CVE-2013-1415 
The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-03T00:00:00.000Z
CVE-2013-1416 
The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-19T10:00:00.000Z
CVE-2013-1417 
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-1418 
The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T02:00:00.000Z
CVE-2013-1420 
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T20:21:27.000Z
CVE-2013-1421 
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2013-1422 
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T13:39:27.000Z
CVE-2013-1423 
(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8) plugins/scmcvs/common/CVSPlugin.class.php, (9) plugins/scmcvs/cronjobs/cvs.php, (10) plugins/scmcvs/cronjobs/ssh_create.php, (11) plugins/scmgit/common/GitPlugin.class.php, (12) plugins/scmsvn/common/SVNPlugin.class.php, (13) plugins/wiki/cronjobs/create_groups.php, (14) utils/cvs1/cvscreate.sh, and (15) utils/include.pl in FusionForge 5.0, 5.1, and 5.2 allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a (1) symlink or (2) hard link attack on certain files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T16:00:00.000Z
CVE-2013-1424 
Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787.
Affected products: vendor: matplotlib
product: matplotlib
default_status: unaffected
Published: 2025-06-26T20:02:13.658Z
CVE-2013-1425 
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
Problem types: description: Insecure Permissions
Affected products: vendor: ldap-git-backup
product: ldap-git-backup
Published: 2019-11-07T20:40:53.000Z
CVE-2013-1426 
Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.
Problem types: description: Cross-Site Scripting
Affected products: vendor: mahara
product: mahara
Published: 2019-11-07T20:46:19.000Z
CVE-2013-1427 
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T17:00:00.000Z
CVE-2013-1428 
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-26T16:00:00.000Z
CVE-2013-1429 
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.
Problem types: description: Symbolic Link Following
Affected products: vendor: lintian
product: lintian
Published: 2019-11-07T21:42:08.000Z
CVE-2013-1430 
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
Problem types: description: cleartext password exposure
Affected products: vendor: n/a
product: xrdp before 0.9.1
Published: 2016-12-16T09:02:00.000Z
CVE-2013-1431 
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-23T20:00:00.000Z
CVE-2013-1432 
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T17:00:00.000Z
CVE-2013-1434 
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-1435 
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2013-1436 
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2013-1437 
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
Problem types: description: Eval Injection
Affected products: vendor: Perl Toolchain Gang
product: Module-Metadata
Published: 2020-01-28T14:24:02.000Z
CVE-2013-1438 
Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T16:00:00.000Z
CVE-2013-1439 
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-1441 
econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T19:00:00.000Z
CVE-2013-1442 
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T19:00:00.000Z
CVE-2013-1443 
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-23T20:00:00.000Z
CVE-2013-1444 
A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T20:00:00.000Z