rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6402 
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-05T20:00:00.000Z
CVE-2013-6403 
The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T18:00:00.000Z
CVE-2013-6404 
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T11:00:00.000Z
CVE-2013-6407 
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-6408 
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-6409 
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-6410 
nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-6411 
The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T17:00:00.000Z
CVE-2013-6412 
The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a "7," which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T00:00:00.000Z
CVE-2013-6413 
Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors.  NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7384 was assigned for the NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6414 
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6415 
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6416 
Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6417 
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6418 
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-6419 
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T18:00:00.000Z
CVE-2013-6420 
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T02:00:00.000Z
CVE-2013-6421 
The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T18:00:00.000Z
CVE-2013-6422 
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-6424 
Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T19:00:00.000Z
CVE-2013-6425 
Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T19:00:00.000Z
CVE-2013-6426 
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T17:00:00.000Z
CVE-2013-6427 
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T18:00:00.000Z
CVE-2013-6428 
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T17:00:00.000Z
CVE-2013-6429 
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T11:00:00.000Z
CVE-2013-6430 
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Pivotal
product: Spring MVC
Published: 2020-01-10T13:28:11.000Z
CVE-2013-6431 
The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for an IPv6 SIOCADDRT ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T18:00:00.000Z
CVE-2013-6432 
The ping_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping sockets, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging unspecified privileges to execute a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T18:00:00.000Z
CVE-2013-6433 
The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-6434 
The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2013-6435 
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2013-6436 
The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T19:00:00.000Z
CVE-2013-6437 
The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-06T15:00:00.000Z
CVE-2013-6438 
The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-18T01:00:00.000Z
CVE-2013-6439 
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-6440 
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T15:00:00.000Z
CVE-2013-6441 
The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T15:00:00.000Z
CVE-2013-6442 
The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T10:00:00.000Z
CVE-2013-6443 
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T01:00:00.000Z
CVE-2013-6444 
PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-6445 
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-30T14:00:00.000Z
CVE-2013-6446 
The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2013-6447 
Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T00:00:00.000Z
CVE-2013-6448 
The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-23T00:00:00.000Z
CVE-2013-6449 
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-6450 
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-01T15:00:00.000Z
CVE-2013-6451 
Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Wikimedia Foundation
product: MediaWiki
Published: 2020-01-28T14:56:22.000Z
CVE-2013-6452 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-6453 
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-6454 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-6455 
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.
Problem types: description: Path Disclosure
Affected products: vendor: Wikimedia Foundation
product: MediaWiki
Published: 2020-01-28T14:54:22.000Z
CVE-2013-6456 
The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T18:00:00.000Z
CVE-2013-6457 
The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2013-6458 
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2013-6459 
Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T15:00:00.000Z
CVE-2013-6460 
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Problem types: description: while parsing XML documents
Affected products: vendor: Ruby
product: Nokogiri gem
Published: 2019-11-05T14:02:54.000Z
CVE-2013-6461 
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Problem types: description: while parsing XML entities
Affected products: vendor: Ruby
product: Nokogiri gem
Published: 2019-11-05T14:07:42.000Z
CVE-2013-6462 
Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-09T15:00:00.000Z
CVE-2013-6465 
Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T19:00:00.000Z
CVE-2013-6466 
Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T20:00:00.000Z
CVE-2013-6467 
Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T20:00:00.000Z