rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-2085 
Directory traversal vulnerability in apps/files_trashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. (dot dot) in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-2086 
The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-2087 
Multiple cross-site scripting (XSS) vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) movie title to modules/gallery/controllers/movies.php or (2) key variable to modules/gallery/views/error_admin.html.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-2088 
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2089 
Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-2090 
The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-2091 
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
Problem types: description: SQL Injection
Affected products: vendor: dolibarr
product: dolibarr
Published: 2019-11-20T19:52:37.000Z
CVE-2013-2092 
Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
Problem types: description: Cross-Site Scripting
Affected products: vendor: dolibarr
product: dolibarr
Published: 2019-11-20T20:09:11.000Z
CVE-2013-2093 
Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
Problem types: description: Other
Affected products: vendor: dolibarr
product: dolibarr
Published: 2019-11-20T20:13:17.000Z
CVE-2013-2094 
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-14T20:00:00.000Z
CVE-2013-2095 
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
Problem types: description: cartridge_cache.rb URI.prase() command injection
Affected products: vendor: rubygem-openshift-origin-controller
product: rubygem-openshift-origin-controller
Published: 2019-12-10T13:21:05.000Z
CVE-2013-2096 
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-09T17:00:00.000Z
CVE-2013-2097 
ZPanel through 10.1.0 has Remote Command Execution
Problem types: description: Remote Command Execution
Affected products: vendor: ZPanel
product: ZPanel
Published: 2020-02-12T15:09:01.000Z
CVE-2013-2099 
Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-2100 
The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-29T22:00:00.000Z
CVE-2013-2101 
Katello has multiple XSS issues in various entities
Problem types: description: Multiple XSS in various entities
Affected products: vendor: Katello
product: Katello
Published: 2019-12-03T13:08:36.000Z
CVE-2013-2102 
The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T21:00:00.000Z
CVE-2013-2103 
OpenShift cartridge allows remote URL retrieval
Problem types: description: remote URL retrieval
Affected products: vendor: OpenShift cartridge
product: OpenShift cartridge
Published: 2019-12-03T13:11:05.000Z
CVE-2013-2104 
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z
CVE-2013-2105 
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2013-2106 
webauth before 4.6.1 has authentication credential disclosure
Problem types: description: credential disclosure
Affected products: vendor: webauth
product: webauth
Published: 2019-12-03T13:21:11.000Z
CVE-2013-2107 
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php.  NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T00:00:00.000Z
CVE-2013-2108 
WordPress WP Cleanfix Plugin 2.4.4 has CSRF
Problem types: description: CSRF
Affected products: vendor: WP Cleanfix Plugin authors
product: WP Cleanfix Plugin
Published: 2020-02-10T16:07:03.000Z
CVE-2013-2109 
WordPress plugin wp-cleanfix has Remote Code Execution
Problem types: description: Code Execution
Affected products: vendor: wp-cleanfix authors
product: wp-cleanfix
Published: 2020-02-10T16:12:55.000Z
CVE-2013-2110 
Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to the quoted_printable_encode function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-21T20:00:00.000Z
CVE-2013-2111 
The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-2112 
The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2113 
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2114 
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-2115 
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T19:00:00.000Z
CVE-2013-2116 
The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length.  NOTE: this might be due to an incorrect fix for CVE-2013-0169.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-03T18:00:00.000Z
CVE-2013-2117 
Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T18:00:00.000Z
CVE-2013-2118 
SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-09T17:00:00.000Z
CVE-2013-2119 
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T21:00:00.000Z
CVE-2013-2120 
The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack.
Problem types: description: Insufficient Random Number Generation
Affected products: vendor: n/a
product: KDE Paste Applet
Published: 2020-02-11T19:03:18.000Z
CVE-2013-2121 
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T10:00:00.000Z
CVE-2013-2122 
The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-2123 
The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attackers to modify the content via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-28T15:00:00.000Z
CVE-2013-2124 
Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-2125 
OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-27T15:00:00.000Z
CVE-2013-2126 
Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-14T15:00:00.000Z
CVE-2013-2127 
Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-14T15:00:00.000Z
CVE-2013-2128 
The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-2129 
Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-24T16:13:00.000Z
CVE-2013-2130 
ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z
CVE-2013-2131 
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-04T21:00:00.000Z
CVE-2013-2132 
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-15T17:00:00.000Z
CVE-2013-2133 
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-06T17:00:00.000Z
CVE-2013-2134 
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-2135 
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-16T18:00:00.000Z
CVE-2013-2136 
Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-2137 
Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-15T16:00:00.000Z
CVE-2013-2138 
The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers to have an unspecified impact via a replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T00:00:00.000Z
CVE-2013-2139 
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T02:00:00.000Z
CVE-2013-2140 
The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-25T10:00:00.000Z
CVE-2013-2141 
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-2142 
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T16:00:00.000Z
CVE-2013-2143 
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-17T14:00:00.000Z
CVE-2013-2144 
Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-03T18:00:00.000Z
CVE-2013-2145 
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-2146 
arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-2147 
The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-2148 
The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2013-2149 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-2150 
Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T16:00:00.000Z
CVE-2013-2151 
Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a crafted application in an unspecified folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z