rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4503 
Cross-site scripting (XSS) vulnerability in the Feed Element Mapper module for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via vectors related to options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4504 
The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4505 
The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4507 
Cross-site scripting (XSS) vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4508 
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-08T02:00:00.000Z
CVE-2013-4509 
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T19:00:00.000Z
CVE-2013-4510 
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4511 
Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4512 
Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4513 
Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4514 
Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4515 
The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4516 
The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-4517 
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-11T01:00:00.000Z
CVE-2013-4518 
RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates
Problem types: description: PKI entitlement certificates are world readable
Affected products: vendor: RHUI
product: RHUI
Published: 2019-11-04T12:58:36.000Z
CVE-2013-4519 
Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T20:00:00.000Z
CVE-2013-4520 
xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, which causes a structure to be accessed as a different type.  NOTE: this issue is due to an incomplete fix for CVE-2012-2825.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T20:00:00.000Z
CVE-2013-4521 
RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.
Problem types: description: Other
Affected products: vendor: Nuxeo
product: Nuxeo Platform
Published: 2020-02-06T15:43:41.000Z
CVE-2013-4522 
lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T02:00:00.000Z
CVE-2013-4523 
Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T02:00:00.000Z
CVE-2013-4524 
Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T02:00:00.000Z
CVE-2013-4525 
Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T02:00:00.000Z
CVE-2013-4526 
Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4527 
Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4529 
Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4530 
Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4531 
Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4532 
Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
Problem types: description: Buffer Overflow
Affected products: vendor: qemu
product: qemu
Published: 2020-01-02T15:26:40.000Z
CVE-2013-4533 
Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4534 
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4535 
The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.
Problem types: description: Integer Signedness Error
Affected products: vendor: n/a
product: QEMU
Published: 2020-02-11T15:35:48.000Z
CVE-2013-4536 
An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: n/a
product: qemu
Published: 2021-05-28T16:58:49.000Z
CVE-2013-4537 
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4538 
Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4539 
Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4540 
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4541 
The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4542 
The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-4544 
hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-4545 
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4546 
The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4547 
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-4548 
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-08T15:00:00.000Z
CVE-2013-4549 
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-4550 
Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. NOTE: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T18:00:00.000Z
CVE-2013-4551 
Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4552 
lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4553 
The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T19:00:00.000Z
CVE-2013-4554 
Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T19:00:00.000Z
CVE-2013-4555 
Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4556 
Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4557 
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4558 
The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4559 
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4560 
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4561 
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: n/a
product: openshift-origin-msg-node-mcollective
Published: 2022-06-30T18:40:58.000Z
CVE-2013-4562 
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4563 
The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4564 
Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T17:00:00.000Z
CVE-2013-4565 
Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-25T17:00:00.000Z
CVE-2013-4566 
mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T18:00:00.000Z
CVE-2013-4567 
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-4568 
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-4569 
The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z