rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6323 
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-01T17:00:00.000Z
CVE-2013-6325 
IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption) via a crafted request to a web services endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T20:00:00.000Z
CVE-2013-6327 
Cross-site scripting (XSS) vulnerability in the HTTP Option in IBM Sterling Connect:Enterprise 1.3 before 1.3.0.2 iFix 1 and 1.4 before 1.4.0.0 iFix 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross-frame scripting" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T11:00:00.000Z
CVE-2013-6328 
Cross-site scripting (XSS) vulnerability in the Web Content Manager (WCM) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-22T15:00:00.000Z
CVE-2013-6329 
IBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of service via a crafted handshake during resumption of an SSLv2 session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T11:00:00.000Z
CVE-2013-6330 
IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T20:00:00.000Z
CVE-2013-6331 
SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6302.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-05T11:00:00.000Z
CVE-2013-6332 
Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to execute arbitrary code by uploading a .jsp file and then launching it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T23:00:00.000Z
CVE-2013-6333 
Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6299, CVE-2013-6300, CVE-2013-6301, and CVE-2013-6320.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-05T11:00:00.000Z
CVE-2013-6334 
IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0.2, and Global Retention Policy and Schedule Management 6.0.1.5 and earlier and 6.0.2 in IBM Atlas Suite (aka Atlas Policy Suite) do not properly validate sessions, which allows remote attackers to bypass intended access restrictions, and visit PolicyAtlas/ResponseDraftServlet (aka the Compliance Questionnaire Save Draft servlet), via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T11:00:00.000Z
CVE-2013-6335 
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and restore operations, which allows local users to bypass intended access restrictions via standard filesystem operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-26T10:00:00.000Z
CVE-2013-6336 
The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6337 
Unspecified vulnerability in the NBAP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6338 
The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6339 
The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6340 
epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly determine the amount of remaining data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6341 
SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T18:00:00.000Z
CVE-2013-6342 
Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin before 4.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tb_tab_index parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-22T15:00:00.000Z
CVE-2013-6343 
Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2) apps_flag parameter to APP_Installation.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T02:00:00.000Z
CVE-2013-6344 
The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows attackers to conduct cross-frame scripting attacks via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T20:00:00.000Z
CVE-2013-6345 
Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vectors related to an "Application Exception."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T20:00:00.000Z
CVE-2013-6346 
Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T20:00:00.000Z
CVE-2013-6347 
Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T20:00:00.000Z
CVE-2013-6348 
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T21:00:00.000Z
CVE-2013-6349 
McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T21:00:00.000Z
CVE-2013-6357 
Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6358 
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:23:59.000Z
CVE-2013-6359 
Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses "multigraph" as a multigraph service name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T17:00:00.000Z
CVE-2013-6360 
TRENDnet TS-S402 has a backdoor to enable TELNET.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T22:56:07.000Z
CVE-2013-6362 
Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T22:54:28.000Z
CVE-2013-6364 
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T13:43:51.000Z
CVE-2013-6365 
Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T13:53:25.000Z
CVE-2013-6366 
The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T15:00:00.000Z
CVE-2013-6367 
The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T18:00:00.000Z
CVE-2013-6368 
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T18:00:00.000Z
CVE-2013-6369 
Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-11T14:00:00.000Z
CVE-2013-6370 
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T14:00:00.000Z
CVE-2013-6371 
The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T14:00:00.000Z
CVE-2013-6372 
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-6373 
The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-25T19:00:00.000Z
CVE-2013-6374 
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-25T19:00:00.000Z
CVE-2013-6375 
Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-6376 
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T18:00:00.000Z
CVE-2013-6378 
The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T02:00:00.000Z
CVE-2013-6380 
The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T02:00:00.000Z
CVE-2013-6381 
Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T02:00:00.000Z
CVE-2013-6382 
Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T02:00:00.000Z
CVE-2013-6383 
The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-27T02:00:00.000Z
CVE-2013-6384 
(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6385 
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T21:00:00.000Z
CVE-2013-6386 
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T21:00:00.000Z
CVE-2013-6387 
Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T20:00:00.000Z
CVE-2013-6388 
Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T20:00:00.000Z
CVE-2013-6389 
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T21:00:00.000Z
CVE-2013-6391 
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-14T17:00:00.000Z
CVE-2013-6392 
The genlock_dev_ioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted GENLOCK_IOC_EXPORT ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-30T02:00:00.000Z
CVE-2013-6393 
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T22:00:00.000Z
CVE-2013-6394 
Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-6395 
Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web script or HTML via the host_regex parameter to the default URI, which is processed by get_context.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T18:00:00.000Z
CVE-2013-6396 
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T19:00:00.000Z
CVE-2013-6397 
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT.  NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-6398 
The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass intended restrictions via a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-14T18:00:00.000Z
CVE-2013-6399 
Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2013-6400 
Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T17:00:00.000Z
CVE-2013-6401 
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T18:00:00.000Z