rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-7275 
Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7276 
Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the current_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7277 
Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to saa.php, (2) username parameter to login.php, or (3) keyword_list parameter to keysearch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7278 
SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7279 
Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7280 
Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of service (crash) via a long string in a .m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z
CVE-2013-7281 
The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T16:00:00.000Z
CVE-2013-7282 
The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36_NIS01 allows remote attackers to bypass authentication via a "Cookie: :language=en" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T11:00:00.000Z
CVE-2013-7283 
Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-09T16:00:00.000Z
CVE-2013-7284 
The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7285 
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-15T16:54:57.000Z
CVE-2013-7286 
MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T17:45:49.000Z
CVE-2013-7287 
MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T22:09:38.000Z
CVE-2013-7288 
Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2013-7289 
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, (3) email, or (4) username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2013-7290 
The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T21:00:00.000Z
CVE-2013-7291 
memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T21:00:00.000Z
CVE-2013-7292 
VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote authenticated users to bypass Active Directory (AD) authentication by entering only a DIGIPASS one-time password, instead of the intended combination of this one-time password and a multiple-time AD password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T15:00:00.000Z
CVE-2013-7293 
The ASUS WL-330NUL router has a configuration process that relies on accessing the 192.168.1.1 IP address, but the documentation advises users to instead access a DNS hostname that does not always resolve to 192.168.1.1, which makes it easier for remote attackers to hijack the configuration traffic by controlling the server associated with that hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-15T02:00:00.000Z
CVE-2013-7294 
The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T02:00:00.000Z
CVE-2013-7295 
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-17T19:00:00.000Z
CVE-2013-7296 
The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string, which allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T01:00:00.000Z
CVE-2013-7298 
query_params.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T20:00:00.000Z
CVE-2013-7299 
framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T20:00:00.000Z
CVE-2013-7300 
Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server.  NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-02T00:00:00.000Z
CVE-2013-7301 
Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading the songs in the queue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-02T00:00:00.000Z
CVE-2013-7302 
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7303 
Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T21:00:00.000Z
CVE-2013-7304 
Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T19:00:00.000Z
CVE-2013-7305 
fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T19:00:00.000Z
CVE-2013-7306 
The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7307 
The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7308 
The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7309 
The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7310 
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7311 
The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7312 
The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7313 
The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7314 
The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T17:00:00.000Z
CVE-2013-7315 
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T21:00:00.000Z
CVE-2013-7316 
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T15:00:00.000Z
CVE-2013-7317 
Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) settings_file or (2) data_file parameter to (a) ampie.swf, (b) amline.swf, or (c) amcolumn.swf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T15:00:00.000Z
CVE-2013-7318 
Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T18:00:00.000Z
CVE-2013-7319 
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-7320 
Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-7321 
Cross-site scripting (XSS) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-7322 
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2013-7323 
python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-09T19:00:00.000Z
CVE-2013-7324 
Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound volume via malicious javascript. NOTE: this WebKit-GTK behavior complies with existing W3C standards and existing practices for GNOME desktop integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T18:24:21.000Z
CVE-2013-7325 
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-03T22:23:50.000Z
CVE-2013-7326 
Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to modules\com_vtiger_workflow\savetemplate.php, or unspecified vectors to (2) deletetask.php, (3) edittask.php, (4) savetask.php, or (5) saveworkflow.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T19:00:00.000Z
CVE-2013-7327 
The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value, a different vulnerability than CVE-2013-7226.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T11:00:00.000Z
CVE-2013-7328 
Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service (application crash) or obtain sensitive information via an imagecrop function call with a negative value for the (1) x or (2) y dimension, a different vulnerability than CVE-2013-7226.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T11:00:00.000Z
CVE-2013-7329 
The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dump_html function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2013-7330 
Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-17T15:00:00.000Z
CVE-2013-7331 
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T11:00:00.000Z
CVE-2013-7332 
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T11:00:00.000Z
CVE-2013-7333 
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect individual switches from the SDN controller, causing degradation and eventually denial of network access to all devices connected to the targeted switch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:46:21.000Z
CVE-2013-7334 
Cross-site request forgery (CSRF) vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter, related to CVE-2012-6290.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T16:00:00.000Z
CVE-2013-7335 
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-12T14:00:00.000Z