rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-0237 
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-0238 
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0239 
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T22:00:00.000Z
CVE-2013-0240 
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-28T17:00:00.000Z
CVE-2013-0241 
The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0242 
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T20:00:00.000Z
CVE-2013-0243 
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
Problem types: description: constraints vulnerability
Affected products: vendor: haskell-tls-extra
product: haskell-tls-extra
Published: 2019-12-05T15:16:46.000Z
CVE-2013-0244 
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T17:00:00.000Z
CVE-2013-0245 
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-0246 
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-0247 
OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T19:00:00.000Z
CVE-2013-0248 
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-15T01:00:00.000Z
CVE-2013-0249 
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-08T22:00:00.000Z
CVE-2013-0250 
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-06T14:00:00.000Z
CVE-2013-0251 
Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0252 
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T21:00:00.000Z
CVE-2013-0253 
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-0254 
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-06T11:00:00.000Z
CVE-2013-0255 
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0256 
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T02:00:00.000Z
CVE-2013-0257 
The email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes, which allows remote attackers to read images of user email addresses and email fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0258 
The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0259 
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0260 
Unspecified vulnerability in the Drush Debian Packaging module for Drupal allows local users to obtain database credentials via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0261 Packstack: packstack: arbitrary file overwrite via symlink attack
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
Problem types: cwe_id: CWE-59
description: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
cpes: cpe:/a:redhat:openstack:5::el6
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 4
cpes: cpe:/a:redhat:openstack:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2013-03-08T21:00:00.000Z
CVE-2013-0262 
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T20:00:00.000Z
CVE-2013-0263 
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T20:00:00.000Z
CVE-2013-0264 
An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
Problem types: description: General Configuration Problem
Affected products: vendor: cumin
product: cumin
Published: 2019-12-30T21:38:54.000Z
CVE-2013-0265 
The redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow local users to overwrite arbitrary files via a symlink attack on /tmp/xnbd.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0266 Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
cpes: cpe:/a:redhat:openstack:5::el6
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 4
cpes: cpe:/a:redhat:openstack:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2013-03-08T21:00:00.000Z
CVE-2013-0267 
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of service, or conduct cross-site scripting (XSS) attacks by leveraging improper data validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-21T15:00:00.000Z
CVE-2013-0268 
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2013-0269 
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0270 Keystone: openstack keystone: denial of service via large http request with long tenant name
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
Problem types: cwe_id: CWE-1284
description: Improper Validation of Specified Quantity in Input
Affected products: vendor: Red Hat
product: Red Hat OpenStack Platform 13 (Queens)
cpes: cpe:/a:redhat:openstack:13
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
cpes: cpe:/a:redhat:openstack:16.2
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
cpes: cpe:/a:redhat:openstack:16.2
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 17.1
cpes: cpe:/a:redhat:openstack:17.1
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 17.1
cpes: cpe:/a:redhat:openstack:17.1
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 18.0
cpes: cpe:/a:redhat:openstack:18.0
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 18.0
cpes: cpe:/a:redhat:openstack:18.0
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2013-04-12T22:00:00.000Z
CVE-2013-0271 
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-16T21:00:00.000Z
CVE-2013-0272 
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-16T21:00:00.000Z
CVE-2013-0273 
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-16T21:00:00.000Z
CVE-2013-0274 
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-16T21:00:00.000Z
CVE-2013-0275 
Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T16:00:00.000Z
CVE-2013-0276 
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0277 
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0281 
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-0282 
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-12T22:00:00.000Z
CVE-2013-0283 
Katello: Username in Notification page has cross site scripting
Problem types: description: Username in Notification page XSS
Affected products: vendor: Katello
product: Katello
Published: 2019-12-05T16:02:14.000Z
CVE-2013-0284 
Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-0285 
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-0286 
Pinboard 1.0.6 theme for Wordpress has XSS.
Problem types: description: XSS
Affected products: vendor: Pinboard theme authors
product: Pinboard theme
Published: 2020-01-27T14:22:18.000Z
CVE-2013-0287 
The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T16:00:00.000Z
CVE-2013-0288 
nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2013-0289 
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T14:00:00.000Z
CVE-2013-0290 
The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-19T19:00:00.000Z
CVE-2013-0291 
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
Problem types: description: Path Disclosure
Affected products: vendor: NextGEN Gallery Plugin authors
product: NextGEN Gallery Plugin
Published: 2020-01-30T13:00:16.000Z
CVE-2013-0292 
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2013-0293 
oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
Problem types: description: screen accepts F2 to drop to shell
Affected products: vendor: oVirt Node
product: oVirt Node
Published: 2019-12-10T13:14:17.000Z
CVE-2013-0294 
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
Problem types: description: Cryptography
Affected products: vendor: pyrad
product: pyrad
Published: 2020-01-28T15:53:24.000Z
CVE-2013-0296 
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T21:00:00.000Z