rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-3241 
export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-26T01:00:00.000Z
CVE-2013-3242 
plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-03T10:00:00.000Z
CVE-2013-3243 
Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-3244 
Multiple unspecified vulnerabilities in the CJDB_FILL_MEMORY_FROM_PPB function in the Project System (PS-IS) module for SAP ERP Central Component (ECC) allow remote attackers to execute arbitrary code via a (1) RFC or (2) SOAP-RFC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-24T00:00:00.000Z
CVE-2013-3245 
plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception.  NOTE: the vendor disputes the severity and claimed vulnerability type of this issue, stating "This PoC crashes VLC, indeed, but does nothing more... this is not an integer overflow error, but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort, not execute random code, on my Linux 64bits machine." A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read, but the affected instruction does not involve a register that directly influences control flow
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T19:00:00.000Z
CVE-2013-3246 
Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer in an XCF file.
Problem types: description: Buffer Overflow
Affected products: vendor: XnView
product: XnView
Published: 2020-01-02T19:38:44.000Z
CVE-2013-3247 
Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compressed layer in an XCF file.
Problem types: description: Buffer Overflow
Affected products: vendor: XnView
product: XnView
Published: 2020-01-02T19:38:36.000Z
CVE-2013-3248 
Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf or .xps file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T23:00:00.000Z
CVE-2013-3249 
Stack-based buffer overflow in the "Add from text file" feature in the DameWare Exporter tool (DWExporter.exe) in DameWare Remote Support 10.0.0.372, 9.0.1.247, and earlier allows user-assisted attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T16:00:00.000Z
CVE-2013-3250 
Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T20:00:00.000Z
CVE-2013-3251 
Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T14:00:00.000Z
CVE-2013-3252 
Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T14:00:00.000Z
CVE-2013-3253 
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T18:00:00.000Z
CVE-2013-3254 
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T10:00:00.000Z
CVE-2013-3256 
Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authentication of users for requests that "manipulate plugin settings."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-08T20:00:00.000Z
CVE-2013-3257 
Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-3258 
Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-3259 
Stack-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUsed value in a BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2013-3260 
Heap-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUsed value in a BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2013-3261 
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-01T10:00:00.000Z
CVE-2013-3262 
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T21:00:00.000Z
CVE-2013-3263 
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-3264 
The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-3266 
The nfsrvd_readdir function in sys/fs/nfsserver/nfs_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify that a READDIR request is for a directory node, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by specifying a plain file instead of a directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T10:00:00.000Z
CVE-2013-3267 
Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-03T10:00:00.000Z
CVE-2013-3268 
Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-24T10:00:00.000Z
CVE-2013-3269 
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitrary users for requests that change mobile passwords, a different vulnerability than CVE-2013-2305.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T10:00:00.000Z
CVE-2013-3270 
EMC VNX Control Station before 7.1.70.2 and Celerra Control Station before 6.0.70.1 have an incorrect group ownership for unspecified script files, which allows local users to gain privileges by leveraging nasadmin group membership.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-19T10:00:00.000Z
CVE-2013-3271 
EMC RSA Authentication Agent for PAM 7.0 before 7.0.2.1 enforces the maximum number of login attempts within the PAM-enabled application codebase, instead of within the Agent codebase, which makes it easier for remote attackers to discover correct login credentials via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T10:00:00.000Z
CVE-2013-3272 
EMC Replication Manager (RM) before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-3273 
EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-3274 
EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly determine authorization for calls to Java RMI methods, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T22:00:00.000Z
CVE-2013-3275 
EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilities."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T22:00:00.000Z
CVE-2013-3276 
EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-05T10:00:00.000Z
CVE-2013-3277 
Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-05T10:00:00.000Z
CVE-2013-3278 
EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password, which allows local users to obtain sensitive information by reading the management-server configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T01:00:00.000Z
CVE-2013-3279 
EMC Atmos before 2.1.4 has a blank password for the PostgreSQL account, which allows remote attackers to obtain sensitive administrative information via a database-server connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-16T20:00:00.000Z
CVE-2013-3280 
EMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a fail-open design, which allows remote attackers to bypass intended access restrictions via vectors that trigger an agent crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-25T01:00:00.000Z
CVE-2013-3281 
Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-06T11:00:00.000Z
CVE-2013-3285 
The NetWorker Management Console (NMC) in EMC NetWorker 8.0.x before 8.0.2.3, when using Active Directory/LDAP for authentication, allows remote authenticated users to discover cleartext administrator passwords via (1) unspecified NMC audit reports or (2) requests to RAP resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-3286 
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4 P11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-06T11:00:00.000Z
CVE-2013-3287 
EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDAP bind password by reading the console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-3288 
Cross-site scripting (XSS) vulnerability on the EMC RSA Data Protection Manager (DPM) appliance 3.2.x before 3.2.4.2 and 3.5.x before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-22T17:00:00.000Z
CVE-2013-3294 
Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-11T17:00:00.000Z
CVE-2013-3295 
Directory traversal vulnerability in install/popup.php in Exponent CMS before 2.2.0 RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-30T02:00:00.000Z
CVE-2013-3299 
RealNetworks RealPlayer 16.0.2.32 and earlier allows remote attackers to cause a denial of service (resource consumption or application crash) via an HTML document containing JavaScript code that constructs a long string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-06T10:00:00.000Z
CVE-2013-3300 
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-26T17:00:00.000Z
CVE-2013-3301 
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T10:00:00.000Z
CVE-2013-3302 
Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-29T10:00:00.000Z
CVE-2013-3304 
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-30T14:00:00.000Z
CVE-2013-3307 
Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Linksys
product: E1000
default_status: unknown
vendor: Linksys
product: E1200
default_status: unaffected
vendor: Linksys
product: E3200
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Published: 2025-07-11T00:00:00.000Z
CVE-2013-3311 
Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (dot dot) in the URL of an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T19:39:31.000Z
CVE-2013-3312 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration, as demonstrated by a request to set_users.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T19:39:28.000Z
CVE-2013-3313 
The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T19:39:23.000Z
CVE-2013-3314 
The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), timestamp, serial number, p2p port number, and wifi status via a request to get_status.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T19:39:18.000Z
CVE-2013-3315 
The server in TIBCO Silver Mobile 1.1.0 does not properly verify access to the administrator role before executing a command, which allows authenticated users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-31T21:00:00.000Z
CVE-2013-3316 
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T21:15:44.000Z
CVE-2013-3317 
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T21:18:35.000Z
CVE-2013-3319 
The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-16T17:00:00.000Z
CVE-2013-3320 
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T21:34:38.000Z
CVE-2013-3321 
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T21:40:44.000Z
CVE-2013-3322 
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T13:40:02.000Z
CVE-2013-3323 
A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalidate the authentication session, which could let a malicious user obtain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T16:03:12.000Z