rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4570 
The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4571 
Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4572 
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
Problem types: description: Other
Affected products: vendor: Wikimedia Foundation
product: MediaWiki
Published: 2020-02-06T14:40:13.000Z
CVE-2013-4573 
Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-25T19:00:00.000Z
CVE-2013-4574 
Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4575 
Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-04T20:00:00.000Z
CVE-2013-4576 
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T21:00:00.000Z
CVE-2013-4577 
A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4578 
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T22:00:00.000Z
CVE-2013-4579 
The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4580 
GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4581 
GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-4582 
The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.
Problem types: description: Path Disclosure
Affected products: vendor: GitLab
product: GitLab
vendor: GitLab
product: GitLab Community Edition
vendor: GitLab
product: GitLab Enterprise Edition
vendor: GitLab
product: gitlab-shell
Published: 2020-01-28T15:17:23.000Z
CVE-2013-4583 
The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: GitLab
product: GitLab
vendor: GitLab
product: GitLab Community Edition
vendor: GitLab
product: GitLab Enterprise Edition
vendor: GitLab
product: gitlab-shell
Published: 2020-01-28T15:11:45.000Z
CVE-2013-4584 
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
Problem types: description: not applied to STARTTLS connections
Affected products: vendor: Perdition
product: Perdition
Published: 2019-11-15T14:04:20.000Z
CVE-2013-4587 
Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T18:00:00.000Z
CVE-2013-4588 
Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4589 
The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4590 
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T11:00:00.000Z
CVE-2013-4591 
Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4592 
Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T15:00:00.000Z
CVE-2013-4593 
RubyGem omniauth-facebook has an access token security vulnerability
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: omniauth-facebook
product: omniauth-facebook
Published: 2019-12-11T13:45:01.000Z
CVE-2013-4594 
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T22:00:00.000Z
CVE-2013-4595 
The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and makes it easier for remote attackers to obtain sensitive information via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T19:00:00.000Z
CVE-2013-4596 
The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-4597 
The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T19:00:00.000Z
CVE-2013-4598 
The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attackers to access the configuration pages via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-4599 
The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is set to a high value, allows remote attackers to cause a denial of service (process consumption) via multiple requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T19:00:00.000Z
CVE-2013-4600 
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to system/login/index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T21:00:00.000Z
CVE-2013-4602 
A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T21:17:19.000Z
CVE-2013-4604 
Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T14:00:00.000Z
CVE-2013-4608 
Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving the Graphical Data View & Descriptive Stats page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-4609 
REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via (1) the Online Designer or (2) the Data Dictionary upload, as demonstrated by an eval call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-4610 
Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-4611 
Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page or (2) the Manage Survey Participants page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-4612 
Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-4613 
The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE: the vendor has apparently responded by stating "for user convenience, the default setting does not require a password. However, if a user has a particular concern about third parties accessing the user's home printer, the default setting can be changed to add a password."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T21:00:00.000Z
CVE-2013-4614 
English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphrase in cleartext, which allows physically proximate attackers to obtain sensitive information by reading the screen of an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T21:00:00.000Z
CVE-2013-4615 
The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html.  NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T21:00:00.000Z
CVE-2013-4616 
The WifiPasswordController generateDefaultPassword method in Preferences in Apple iOS 6 and earlier relies on the UITextChecker suggestWordInLanguage method for selection of Wi-Fi hotspot WPA2 PSK passphrases, which makes it easier for remote attackers to obtain access via a brute-force attack that leverages the insufficient number of possible passphrases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-18T14:00:00.000Z
CVE-2013-4617 
Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T18:00:00.000Z
CVE-2013-4619 
Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/chart_tracker.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T21:00:00.000Z
CVE-2013-4620 
Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T21:00:00.000Z
CVE-2013-4621 
Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T16:21:24.000Z
CVE-2013-4622 
The 3G Mobile Hotspot feature on the HTC Droid Incredible has a default WPA2 PSK passphrase of 1234567890, which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-19T10:00:00.000Z
CVE-2013-4623 
The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T20:00:00.000Z
CVE-2013-4624 
Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp, (2) the searchString parameter to administration/ in a search action, or the (3) username, (4) firstName, (5) lastName, (6) email, or (7) organization field to administration/ in a users action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T18:00:00.000Z
CVE-2013-4625 
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T21:00:00.000Z
CVE-2013-4626 
Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-26T15:00:00.000Z
CVE-2013-4627 
Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-01T16:00:00.000Z
CVE-2013-4628 
The firewall module on the Huawei Quidway Service Process Unit (SPU) board S7700, S9300, and S9700 on Huawei Campus Switch devices allows remote authenticated users to obtain sensitive information from the high-priority security zone by leveraging access to the low-priority security zone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4629 
The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4630 
Stack-based buffer overflow on Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 debugging is enabled, allows remote attackers to execute arbitrary code via malformed SNMPv3 requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4631 
Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of service (device crash) via malformed SNMPv3 requests that leverage unspecified overflow issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4632 
The Huawei Access Router (AR) before V200R002SPC003 allows remote attackers to cause a denial of service (device reset) via a crafted field in a DHCP request, as demonstrated by a request from an IP phone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4633 
Huawei Seco Versatile Security Manager (VSM) before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T15:00:00.000Z
CVE-2013-4634 
SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-20T23:00:00.000Z
CVE-2013-4635 
Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T21:00:00.000Z
CVE-2013-4636 
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T21:00:00.000Z
CVE-2013-4649 
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-12T14:00:00.000Z
CVE-2013-4650 
MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-04T10:00:00.000Z
CVE-2013-4651 
Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T18:00:00.000Z