rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-1830 
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1831 
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1832 
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1833 
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1834 
notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1835 
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1836 
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-25T21:00:00.000Z
CVE-2013-1838 
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T21:00:00.000Z
CVE-2013-1839 
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T20:00:00.000Z
CVE-2013-1840 
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T21:00:00.000Z
CVE-2013-1841 
Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2013-1842 
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-20T15:00:00.000Z
CVE-2013-1843 
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-20T15:00:00.000Z
CVE-2013-1844 
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T21:00:00.000Z
CVE-2013-1845 
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-1846 
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-1847 
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-1848 
fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1849 
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-1850 
Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1851 
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-1852 
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T15:00:00.000Z
CVE-2013-1853 
Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2013-1854 
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T22:00:00.000Z
CVE-2013-1855 
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T22:00:00.000Z
CVE-2013-1856 
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T22:00:00.000Z
CVE-2013-1857 
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T22:00:00.000Z
CVE-2013-1858 
The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-05T21:00:00.000Z
CVE-2013-1859 
The Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the configuration options, which allows remote attackers to read and edit configuration options via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-1860 
Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T10:00:00.000Z
CVE-2013-1861 
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-28T23:00:00.000Z
CVE-2013-1862 
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-10T17:00:00.000Z
CVE-2013-1863 
Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T17:00:00.000Z
CVE-2013-1864 
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T14:00:00.000Z
CVE-2013-1865 
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T21:00:00.000Z
CVE-2013-1866 
OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability
Problem types: description: Arbitrary File Creation or Overwrite Vulnerability
Affected products: vendor: OpenSC
product: OpenSC.tokend
Published: 2020-01-30T13:07:53.000Z
CVE-2013-1867 
Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability
Problem types: description: Arbitrary File Creation or Overwrite Vulnerability
Affected products: vendor: Gemalto Tokend
product: Gemalto Tokend
Published: 2020-01-30T13:11:27.000Z
CVE-2013-1868 
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T19:00:00.000Z
CVE-2013-1869 
CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via the return_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T01:00:00.000Z
CVE-2013-1871 
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T15:00:00.000Z
CVE-2013-1872 
The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable assertion and crash) and possibly execute arbitrary code via vectors involving 3d graphics that trigger an out-of-bounds array access, related to the fs_visitor::remove_dead_constants function.  NOTE: this issue might be related to CVE-2013-0796.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-1874 
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-29T22:00:00.000Z
CVE-2013-1875 
command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-20T22:00:00.000Z
CVE-2013-1879 
Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-18T01:00:00.000Z
CVE-2013-1880 
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T18:00:00.000Z
CVE-2013-1881 
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T00:00:00.000Z
CVE-2013-1883 
Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-1884 
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-1885 
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T16:00:00.000Z
CVE-2013-1886 
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T16:00:00.000Z
CVE-2013-1887 
Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T23:00:00.000Z
CVE-2013-1888 
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-16T10:00:00.000Z
CVE-2013-1889 
mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out of the chroot.
Problem types: description: Other
Affected products: vendor: libapache2-mod-ruid2
product: libapache2-mod-ruid2
Published: 2019-11-08T15:07:10.000Z
CVE-2013-1890 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2013-1891 
In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: opencart
Published: 2022-06-24T15:00:17.000Z
CVE-2013-1892 
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T20:00:00.000Z
CVE-2013-1893 
SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to the contacts application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2013-1895 
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Problem types: description: Other
Affected products: vendor: py-bcrypt
product: py-bcrypt
Published: 2020-01-28T14:30:24.000Z
CVE-2013-1896 
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T20:00:00.000Z
CVE-2013-1897 
The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-1898 
lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T20:00:00.000Z
CVE-2013-1899 
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T17:00:00.000Z