rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4652 
Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote attackers to bypass authentication and execute arbitrary code via a (1) SSH or (2) TELNET connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T18:00:00.000Z
CVE-2013-4653 
Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-20T00:00:00.000Z
CVE-2013-4654 
Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T15:56:46.000Z
CVE-2013-4655 
Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T15:16:12.000Z
CVE-2013-4656 
Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T14:44:05.000Z
CVE-2013-4657 
Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T17:33:39.000Z
CVE-2013-4658 
Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-25T16:10:15.000Z
CVE-2013-4659 
Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. This component is used on routers of multiple vendors including ASUS RT-AC66U and TRENDnet TEW-812DRU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T09:02:00.000Z
CVE-2013-4660 
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-28T14:00:00.000Z
CVE-2013-4661 
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T18:00:00.000Z
CVE-2013-4662 
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T18:00:00.000Z
CVE-2013-4663 
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-28T00:00:00.000Z
CVE-2013-4664 
SPBAS Business Automation Software 2012 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T15:44:00.000Z
CVE-2013-4665 
SPBAS Business Automation Software 2012 has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T15:46:18.000Z
CVE-2013-4668 
Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T14:00:00.000Z
CVE-2013-4669 
FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T14:00:00.000Z
CVE-2013-4670 
Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T15:00:00.000Z
CVE-2013-4671 
Cross-site request forgery (CSRF) vulnerability in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T15:00:00.000Z
CVE-2013-4672 
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T15:00:00.000Z
CVE-2013-4673 
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T15:00:00.000Z
CVE-2013-4674 
Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-4676 
Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) custom-reports generation page, (2) Storage Devices creation page, or (3) jobs creation page in the management console; or (4) a Backup Exec server-management page in the beutility console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-04T20:00:00.000Z
CVE-2013-4677 
Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions (Everyone: Read and Everyone: Change) for backup data files, which allows local users to obtain sensitive information or modify the outcome of a restore via direct access to these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-04T20:00:00.000Z
CVE-2013-4678 
The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to obtain sensitive host-version information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-04T20:00:00.000Z
CVE-2013-4679 
Symantec Workspace Virtualization before 6.x before 6.4.1953.0, when a virtual application layer is configured, allows local users to gain privileges via an application that performs crafted interaction with the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-04T20:00:00.000Z
CVE-2013-4680 
Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T18:00:00.000Z
CVE-2013-4681 
SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T18:00:00.000Z
CVE-2013-4682 
SQL injection vulnerability in the Multishop extension before 2.0.39 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T18:00:00.000Z
CVE-2013-4683 
SQL injection vulnerability in the meta_feedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-25T18:00:00.000Z
CVE-2013-4684 
flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R8, 12.1 before 12.1R7, and 12.1X44 before 12.1X44-D15 on SRX devices, when PIM and NAT are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted PIM packets, aka PR 842253.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4685 
Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code via crafted HTTP requests, aka PR 849100.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4686 
The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows remote attackers to cause a denial of service (device crash) via a crafted ARP request, aka PR 842091.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4687 
flowd in Juniper Junos 10.4 before 10.4S14, 11.2 and 11.4 before 11.4R6-S2, and 12.1 before 12.1R6 on SRX devices, when certain Application Layer Gateways (ALGs) are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted TCP packets, aka PRs 727980, 806269, and 835593.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4688 
flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices, when the MSRPC Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted MSRPC requests, aka PR 772834.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4689 
J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators for requests that (1) create new administrator accounts or (2) have other unspecified impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4690 
Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data, aka PR 829536, a related issue to CVE-2003-0001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-11T14:00:00.000Z
CVE-2013-4691 
Sencha Labs Connect has XSS with connect.methodOverride()
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T15:39:03.000Z
CVE-2013-4692 
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T16:03:29.000Z
CVE-2013-4693 
WordPress Xorbin Digital Flash Clock 1.0 has XSS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T15:49:41.000Z
CVE-2013-4694 
Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a package with a long Skin directory name.  NOTE: a second buffer overflow involving a long GUI Search field to ml_local.dll was also reported. However, since it is only exploitable by the user of the application, this issue would not cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T22:00:00.000Z
CVE-2013-4695 
Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T16:00:20.000Z
CVE-2013-4697 
Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and 10-01; and Hitachi IT Operations Director 02-50 through 02-50-07, 03-00 through 03-00-12, and 04-00 through 04-00-01 allow remote authenticated users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T01:00:00.000Z
CVE-2013-4698 
Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-16T01:00:00.000Z
CVE-2013-4699 
The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-21T16:00:00.000Z
CVE-2013-4700 
The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-21T16:00:00.000Z
CVE-2013-4701 
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-21T16:00:00.000Z
CVE-2013-4702 
Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-30T21:00:00.000Z
CVE-2013-4703 
Cross-site scripting (XSS) vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-10T10:00:00.000Z
CVE-2013-4704 
Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T01:00:00.000Z
CVE-2013-4705 
Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-13T10:00:00.000Z
CVE-2013-4706 
The SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows remote authenticated users to cause a denial of service (reboot) by leveraging login access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-20T15:00:00.000Z
CVE-2013-4707 
The SSH implementation on D-Link Japan DES-3810 devices with firmware before R2.20.011 allows remote authenticated users to cause a denial of service (device hang) by leveraging login access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-20T15:00:00.000Z
CVE-2013-4708 
The PPP Access Concentrator (PPPAC) in Internet Initiative Japan Inc. SEIL/x86 1.00 through 2.80, SEIL/X1 1.00 through 4.30, SEIL/X2 1.00 through 4.30, SEIL/B1 1.00 through 4.30, SEIL/Turbo 1.80 through 2.15, and SEIL/neu 2FE Plus 1.80 through 2.15 generates predictable random numbers, which allows remote attackers to bypass RADIUS authentication by sniffing RADIUS traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T17:00:00.000Z
CVE-2013-4709 
Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware before 2.82, SEIL/X1 with firmware before 4.32, SEIL/X2 with firmware before 4.32, SEIL/B1 with firmware before 4.32, SEIL/Turbo with firmware before 2.16, and SEIL/neu 2FE Plus with firmware before 2.16 allows remote attackers to execute arbitrary code via a crafted L2TP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-20T15:00:00.000Z
CVE-2013-4710 
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2013-4711 
Cross-site scripting (XSS) vulnerability in Accela BizSearch 3.2 on Linux and Solaris allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T10:00:00.000Z
CVE-2013-4712 
I-O DATA DEVICE HDL-A and HDL2-A devices with firmware 1.07 and earlier do not properly manage sessions, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-19T10:00:00.000Z
CVE-2013-4713 
Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-01T01:00:00.000Z
CVE-2013-4714 
Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-06T11:00:00.000Z
CVE-2013-4715 
SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-06T11:00:00.000Z
CVE-2013-4716 
Cross-site scripting (XSS) vulnerability in Tattyan HP TOWN 5_9_3 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-08T02:00:00.000Z
CVE-2013-4717 
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T18:03:00.000Z
CVE-2013-4718 
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T18:03:05.000Z
CVE-2013-4719 
SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-27T20:00:00.000Z
CVE-2013-4720 
SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-27T20:00:00.000Z