rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-3508 
html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3509 
html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3510 
Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via (1) nedi/html/System-Export.php, (2) nedi/html/Devices-List.php, or (3) the Noma component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3511 
Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3512 
The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to read or modify configuration settings via unspecified vectors, as demonstrated by reading credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3513 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) store XSS sequences or (2) delete entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-08T10:00:00.000Z
CVE-2013-3514 
Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-3515 
Multiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-29T21:00:00.000Z
CVE-2013-3516 
NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T19:30:07.000Z
CVE-2013-3517 
Cross-site scripting (XSS) vulnerability in NETGEAR WNR3500U and WNR3500L.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T18:03:57.000Z
CVE-2013-3519 
lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when a 32-bit Windows guest OS is used, allows guest OS users to gain guest OS privileges via an application that performs a crafted memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-04T15:00:00.000Z
CVE-2013-3520 
VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T01:00:00.000Z
CVE-2013-3522 
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3523 
SQL injection vulnerability in This HTML Is Simple (THIS) before 1.2.4 allows remote to execute arbitrary SQL commands via vectors related to op=page&id= in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3524 
SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3525 
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter.  NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3526 
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3527 
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3528 
Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3529 
Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3530 
SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3531 
SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3532 
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3533 
Multiple SQL injection vulnerabilities in Virtual Access Monitor 3.10.17 and earlier allow attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-10T21:00:00.000Z
CVE-2013-3534 
Cross-site scripting (XSS) vulnerability in the aiContactSafe component before 2.0.21 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-3535 
Multiple cross-site scripting (XSS) vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_email, (2) header_title, (3) site_title parameter to admin/settings; (4) recaptcha_private or (5) recaptcha_public parameter to admin/captcha_settings; (6) fb_appid, (7) fp_secret, (8) tw_consumer_key, or (9) tw_consumer_secret parameter to admin/social_settings; (10) slug parameter to admin/gallery/save_item_settings; or (11) item_link parameter to admin/edit_menu_item_ajax.  NOTE: this issue might be resultant from CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-3536 
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-3537 
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_post or (2) pg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-3538 
Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id_post or (2) pg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-13T23:00:00.000Z
CVE-2013-3539 
Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T19:00:00.000Z
CVE-2013-3540 
Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T23:00:00.000Z
CVE-2013-3541 
Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. (dot dot) in the READ.filePath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T23:00:00.000Z
CVE-2013-3542 
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain access via a TELNET session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T18:07:23.000Z
CVE-2013-3543 
The AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) 6.2.10.11 for AXIS network cameras allows remote attackers to create or overwrite arbitrary files via a file path to the (1) StartRecord, (2) SaveCurrentImage, or (3) StartRecordMedia methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-04T23:00:00.000Z
CVE-2013-3551 
Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-21T15:35:41.000Z
CVE-2013-3552 
Nitro Pro 7.5.0.29 and earlier and Nitro Reader 2.5.0.45 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2013-3553 
Nitro Pro 7.5.0.22 and earlier and Nitro Reader 2.5.0.36 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2013-3555 
epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3556 
The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3557 
The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3558 
The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3559 
epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3560 
The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3561 
Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3562 
Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-25T01:00:00.000Z
CVE-2013-3563 
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-04T10:00:00.000Z
CVE-2013-3564 
The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T21:49:22.000Z
CVE-2013-3565 
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T21:39:19.000Z
CVE-2013-3567 
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-3568 
Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T21:54:52.000Z
CVE-2013-3571 
socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-3572 
Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T20:00:00.000Z
CVE-2013-3573 
HP Insight Diagnostics 9.4.0.4710 allows remote attackers to conduct unspecified injection attacks via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-14T10:00:00.000Z
CVE-2013-3574 
Absolute path traversal vulnerability in hpdiags/frontend2/commands/saveCompareConfig.php in HP Insight Diagnostics 9.4.0.4710 allows remote attackers to write data to arbitrary files via a full pathname in the argument to the devicePath (aka mount) parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-14T10:00:00.000Z
CVE-2013-3575 
hpdiags/frontend2/help/pageview.php in HP Insight Diagnostics 9.4.0.4710 does not properly restrict PHP include or require statements, which allows remote attackers to include arbitrary hpdiags/frontend2/help/ .html files via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-14T10:00:00.000Z
CVE-2013-3576 
ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-14T18:00:00.000Z
CVE-2013-3577 
SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-15T20:00:00.000Z
CVE-2013-3578 
SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to execution of operating-system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-15T20:00:00.000Z
CVE-2013-3579 
The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.lookout.security.ScanTell with zero arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T21:00:00.000Z
CVE-2013-3580 
The TrustGo Antivirus & Mobile Security application before 1.3.6 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.trustgo.mobile.security.USSDScannerActivity with zero arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-28T14:00:00.000Z
CVE-2013-3581 
ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax (1) wmxState or (2) netState request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-29T20:00:00.000Z
CVE-2013-3582 
Buffer overflow in Dell BIOS on Dell Latitude D###, E####, XT2, and Z600 devices, and Dell Precision M#### devices, allows local users to bypass intended BIOS signing requirements and install arbitrary BIOS images by leveraging administrative privileges and providing a crafted rbu_packet.pktNum value in conjunction with a crafted rbu_packet.pktSize value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T10:00:00.000Z
CVE-2013-3583 
Cross-site request forgery (CSRF) vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T01:00:00.000Z
CVE-2013-3584 
Cross-site scripting (XSS) vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T01:00:00.000Z
CVE-2013-3585 
Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive information via vectors involving (1) direct access to a file or (2) the user-setup web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T01:00:00.000Z
CVE-2013-3586 
Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T01:00:00.000Z