rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6912 
Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6913 
Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6914 
Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6915 
Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6916 
Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6918 
The web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes the console without authentication on the WAN IP address regardless of the "Web Management via WAN" setting, which allows remote attackers to bypass intended access restrictions via HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-30T11:00:00.000Z
CVE-2013-6919 
The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-27T18:00:00.000Z
CVE-2013-6920 
Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6922 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts via a crafted request to admin/access_control_user_add.php; (2) modify or (3) delete user accounts; (4) perform a factory reset; (5) perform a device reboot; or (6) add, (7) modify, or (8) delete shares and volumes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T16:00:00.000Z
CVE-2013-6923 
Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname parameter to admin/access_control_user_edit.php or (2) workname parameter to admin/network_workgroup_domain.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-09T15:00:00.000Z
CVE-2013-6924 
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-11T12:00:00.000Z
CVE-2013-6925 
The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T02:00:00.000Z
CVE-2013-6926 
The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on administrative actions by leveraging access to a (1) guest or (2) operator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T02:00:00.000Z
CVE-2013-6927 
Internet TRiLOGI Server (unknown versions) could allow a local user to bypass security and create a local user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T22:51:25.000Z
CVE-2013-6929 
SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6930 
SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T02:00:00.000Z
CVE-2013-6931 
SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T02:00:00.000Z
CVE-2013-6932 
Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6933 
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T21:00:00.000Z
CVE-2013-6934 
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T21:00:00.000Z
CVE-2013-6935 
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-04T15:00:00.000Z
CVE-2013-6936 
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-04T15:00:00.000Z
CVE-2013-6937 
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of the cols element in a .wstyle file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-04T15:00:00.000Z
CVE-2013-6938 
Unspecified vulnerability in the Service VM in Citrix NetScaler SDX 9.3 before 9.3-64.4 and 10.0 before 10.0-77.5 and Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors, related to the "Virtual Machine Daemon."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6939 
Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors, related to "RADIUS authentication."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6940 
Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 logs user credentials, which allows attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6941 
Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows users to "breakout" of the shell via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6942 
Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6943 
Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6944 
Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2013-6945 
The M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to bypass authentication and authorization to perform doctor-only actions and read or modify patient records via unspecified vectors related to a "logic flaw."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-04T22:00:00.000Z
CVE-2013-6948 
The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6949 
The Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN protocols, which allows remote attackers to hijack connections and possibly have unspecified other impact by leveraging access to a single WeMo device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6950 
The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6951 
The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6952 
The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6953 
BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T17:00:00.000Z
CVE-2013-6954 
The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-12T15:00:00.000Z
CVE-2013-6955 
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-09T11:00:00.000Z
CVE-2013-6956 
Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r17, 7.3 before 7.3r8, 7.4 before 7.4r6, and 8.0 before 8.0r1, when web rewrite is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-6957 
Cross-site scripting (XSS) vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-6958 
Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause a denial of service via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-6959 
Open redirect vulnerability in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul25557.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6960 
Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meeting Center allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36248.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6961 
Cross-site scripting (XSS) vulnerability in the Collaboration Partner Access Console (CPAC) in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36237.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6962 
Cross-site scripting (XSS) vulnerability in the mobile-browser subsystem in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36228.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6963 
Cross-site scripting (XSS) vulnerability in the registration component in Cisco WebEx Training Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36207.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6964 
Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via unspecified vectors, aka Bug ID CSCul36197.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6965 
The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul36183.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6966 
Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36031.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T02:00:00.000Z
CVE-2013-6967 
Open redirect vulnerability in the mobile-browser subsystem in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36020.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6968 
Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, which allows remote attackers to enumerate attendees via a series of requests, aka Bug ID CSCul36003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6969 
The training-registration page in Cisco WebEx Training Center allows remote attackers to modify unspecified fields via unknown vectors, aka Bug ID CSCul35990.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6970 
Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6971 
Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul57140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6972 
Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6973 
Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T22:00:00.000Z
CVE-2013-6974 
Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud89431.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T11:00:00.000Z
CVE-2013-6975 
Directory traversal vulnerability in the command-line interface in Cisco NX-OS 6.2(2a) and earlier allows local users to read arbitrary files via unspecified input, aka Bug ID CSCul05217.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T10:00:00.000Z
CVE-2013-6976 
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-19T22:00:00.000Z
CVE-2013-6978 
The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-21T11:00:00.000Z
CVE-2013-6979 
The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, aka Bug ID CSCuj90227.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-6981 
Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fragmented MPLS IP packets, aka Bug ID CSCul00709.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6982 
The BGP implementation in Cisco NX-OS 6.2(2a) and earlier does not properly handle the interaction of UPDATE messages with IPv6, VPNv4, and VPNv6 labeled unicast-address families, which allows remote attackers to cause a denial of service (peer reset) via a crafted message, aka Bug ID CSCuj03174.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T21:00:00.000Z
CVE-2013-6983 
SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T11:00:00.000Z
CVE-2013-6985 
SQL injection vulnerability in m_worklog/log_searchday.jsp in Enorth Webpublisher CMS, possibly 5.0 and earlier, allows remote attackers to execute arbitrary SQL commands via the thisday parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T16:00:00.000Z
CVE-2013-6986 
The ZippyYum Subway CA Kiosk app 3.4 for iOS uses cleartext storage in SQLite cache databases, which allows attackers to obtain sensitive information by reading data elements, as demonstrated by password elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T17:00:00.000Z