rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-1772 
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2013-1773 
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2013-1774 
The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2013-1775 
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2013-1776 
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-08T17:00:00.000Z
CVE-2013-1777 
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T22:00:00.000Z
CVE-2013-1778 
Cross-site scripting (XSS) vulnerability in the Creative Theme 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1779 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1780 
Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1781 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1782 
Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1783 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1784 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1785 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1786 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1787 
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1788 
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1789 
splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1790 
poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1792 
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1793 
openstack-utils openstack-db has insecure password creation
Problem types: description: openstack-db insecure password creation for services
Affected products: vendor: openstack-utils
product: openstack-db program
Published: 2019-12-10T13:17:03.000Z
CVE-2013-1794 
Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T16:00:00.000Z
CVE-2013-1795 
Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T16:00:00.000Z
CVE-2013-1796 
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1797 
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1798 
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1799 
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.  NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-28T17:00:00.000Z
CVE-2013-1800 
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1801 
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1802 
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1803 
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-1804 
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T20:00:00.000Z
CVE-2013-1806 
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T22:00:00.000Z
CVE-2013-1807 
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T22:00:00.000Z
CVE-2013-1808 
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-28T17:00:00.000Z
CVE-2013-1809 
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.
Problem types: description: Symbolic Link Following
Affected products: vendor: gambas3
product: gambas3
Published: 2019-11-07T22:18:17.000Z
CVE-2013-1810 
Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2013-1811 
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
Problem types: description: Other
Affected products: vendor: mantis
product: mantis
Published: 2019-11-07T22:28:06.000Z
CVE-2013-1812 
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T18:00:00.000Z
CVE-2013-1813 
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-1814 
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-14T00:00:00.000Z
CVE-2013-1815 Packstack: red hat openstack: packstack: unauthorized system modification via insecure answer file creation
A flaw was found in PackStack. This vulnerability allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creation could lead to unauthorized system modifications.
Problem types: cwe_id: CWE-379
description: Creation of Temporary File in Directory with Insecure Permissions
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
cpes: cpe:/a:redhat:openstack:5::el6
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 4
cpes: cpe:/a:redhat:openstack:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Published: 2013-04-10T15:00:00.000Z
CVE-2013-1816 
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
Problem types: description: Other
Affected products: vendor: mediawiki
product: mediawiki
Published: 2019-11-20T19:22:30.000Z
CVE-2013-1817 
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
Problem types: description: Other
Affected products: vendor: mediawiki
product: mediawiki
Published: 2019-11-20T19:32:38.000Z
CVE-2013-1818 
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-1819 
The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-06T22:00:00.000Z
CVE-2013-1820 
tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.
Problem types: description: Insecure Permissions
Affected products: vendor: tuned
product: tuned
Published: 2019-11-08T14:25:11.000Z
CVE-2013-1821 
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T21:00:00.000Z
CVE-2013-1822 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1823 
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-02T22:00:00.000Z
CVE-2013-1824 
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T01:00:00.000Z
CVE-2013-1826 
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1827 
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1828 
The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1829 
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z