rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6728 
The charting component in IBM WebSphere Dashboard Framework (WDF) 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T02:00:00.000Z
CVE-2013-6729 
Cross-site scripting (XSS) vulnerability in IBM QuickFile 1.0.0.0 before iFix 4 and 1.1.0.1 before iFix 3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-21T10:00:00.000Z
CVE-2013-6730 
IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-04T22:00:00.000Z
CVE-2013-6731 
IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via an HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T11:00:00.000Z
CVE-2013-6732 
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6733 
Cross-site scripting (XSS) vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T11:00:00.000Z
CVE-2013-6734 
IBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does not properly isolate the cached data of different users, which allows remote authenticated users to obtain sensitive information in opportunistic circumstances by leveraging access to the same web container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-22T21:00:00.000Z
CVE-2013-6735 
IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-22T15:00:00.000Z
CVE-2013-6737 
IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-21T15:00:00.000Z
CVE-2013-6738 
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-24T10:00:00.000Z
CVE-2013-6739 
IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z
CVE-2013-6741 
IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20140319-0837 allow remote authenticated users to obtain potentially sensitive stack-trace information by triggering a Birt error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-26T16:00:00.000Z
CVE-2013-6742 
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-13T22:00:00.000Z
CVE-2013-6743 
Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-13T22:00:00.000Z
CVE-2013-6744 
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T23:00:00.000Z
CVE-2013-6745 
Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-22T15:00:00.000Z
CVE-2013-6746 
Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-22T02:00:00.000Z
CVE-2013-6747 
IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-27T16:00:00.000Z
CVE-2013-6748 
Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6749.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T02:00:00.000Z
CVE-2013-6749 
Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6748.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T02:00:00.000Z
CVE-2013-6763 
The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-12T01:00:00.000Z
CVE-2013-6765 
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6766 
OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENT_AUTHENTIC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6767 
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary code or cause a denial of service (process crash) via a long *.text value in a PE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T22:00:00.000Z
CVE-2013-6768 
Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse app_process program via a crafted PATH environment variable for a /system/xbin/su process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T10:00:00.000Z
CVE-2013-6769 
The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T10:00:00.000Z
CVE-2013-6770 
The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T10:00:00.000Z
CVE-2013-6771 
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2013-6772 
Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:34:54.000Z
CVE-2013-6773 
Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:37:36.000Z
CVE-2013-6774 
Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process.  NOTE: another researcher was unable to reproduce this with ChainsDD Superuser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T10:00:00.000Z
CVE-2013-6775 
The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T10:00:00.000Z
CVE-2013-6780 
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6785 
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:16:52.000Z
CVE-2013-6786 
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page.  NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T19:00:00.000Z
CVE-2013-6787 
SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T18:00:00.000Z
CVE-2013-6788 
The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T14:00:00.000Z
CVE-2013-6789 
security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T00:00:00.000Z
CVE-2013-6791 
Microsoft Enhanced Mitigation Experience Toolkit (EMET) before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat the ASLR protection mechanism via a return-oriented programming (ROP) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-29T15:00:00.000Z
CVE-2013-6792 
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:32:13.000Z
CVE-2013-6793 
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote attackers to inject arbitrary web script or HTML via the (1) event name or (2) date field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-14T20:00:00.000Z
CVE-2013-6794 
Cross-site scripting (XSS) vulnerability in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allows remote attackers to inject arbitrary web script or HTML via the Location field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-14T20:00:00.000Z
CVE-2013-6795 
The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T18:00:00.000Z
CVE-2013-6796 
The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-26T20:00:00.000Z
CVE-2013-6797 
Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php, as demonstrated by embedding a URL to a JavaScript file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T20:00:00.000Z
CVE-2013-6798 
BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended restrictions on remote file-access folders via IPv6 WebDAV requests, a different vulnerability than CVE-2013-3694.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T11:00:00.000Z
CVE-2013-6799 
Apple Mac OS X 10.9 allows local users to cause a denial of service (memory corruption or panic) by creating a hard link to a directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0105.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T11:00:00.000Z
CVE-2013-6800 
An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T11:00:00.000Z
CVE-2013-6801 
Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .doc file containing an embedded image, as demonstrated by word2003forkbomb.doc, related to a "fork bomb" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T15:00:00.000Z
CVE-2013-6802 
Google Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions by leveraging access to a renderer process, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013, a different vulnerability than CVE-2013-6632.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T15:00:00.000Z
CVE-2013-6804 
Cross-site scripting (XSS) vulnerability in the Search module before 1.1.1 for Jamroom allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to search/results/all/1/4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T18:00:00.000Z
CVE-2013-6805 
OpenText Exceed OnDemand (EoD) 8 uses weak encryption for passwords, which makes it easier for (1) remote attackers to discover credentials by sniffing the network or (2) local users to discover credentials by reading a .eod8 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6806 
OpenText Exceed OnDemand (EoD) 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6807 
The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-6808 
Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6809 
Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the Remote File field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T17:00:00.000Z
CVE-2013-6810 
The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition (CMCNE), HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T17:00:00.000Z
CVE-2013-6811 
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding, (2) Port Triggering Entries, (3) URL Filters in Parental Control, (4) Print Server settings, (5) QoS Queue Setup, or (6) QoS Classification Entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T17:50:45.000Z
CVE-2013-6812 
The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6814 
The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6815 
The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6816 
Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6817 
Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z