rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4432 
Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders (1) by leveraging an active folder tab loaded before permissions were removed or (2) via the folder parameter to artefact/file/groupfiles.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4433 
Cross-site scripting (XSS) vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4434 
Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-25T23:00:00.000Z
CVE-2013-4435 
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-4436 
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-4437 
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-4438 
Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.  NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-4439 
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-4440 
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2013-4441 
The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.
Problem types: description: Password
Affected products: vendor: Pwgen
product: Pwgen
Published: 2020-01-27T16:08:55.000Z
CVE-2013-4442 
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2013-4444 
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-12T01:00:00.000Z
CVE-2013-4445 
The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal uses Drupal's token scheme to restrict access to blocks, which makes it easier for remote authenticated users to guess the access token for a block by leveraging the token from a block to which the user has access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4446 
The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4447 
Cross-site scripting (XSS) vulnerability in the API in the Simplenews module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-01T14:00:00.000Z
CVE-2013-4449 
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T18:00:00.000Z
CVE-2013-4450 
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-21T17:00:00.000Z
CVE-2013-4451 
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2013-4452 
Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T19:00:00.000Z
CVE-2013-4453 
Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-4454 
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
Problem types: description: Security Bypass
Affected products: vendor: Portable phpMyAdmin Plugin authors
product: Portable phpMyAdmin Plugin
Published: 2020-02-18T13:23:13.000Z
CVE-2013-4455 
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-4457 
The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T18:00:00.000Z
CVE-2013-4458 
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-12T18:00:00.000Z
CVE-2013-4459 
LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-4460 
Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T15:00:00.000Z
CVE-2013-4461 
SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-4462 
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
Problem types: description: auth bypass
Affected products: vendor: Portable phpMyAdmin Plugin authors
product: Portable phpMyAdmin Plugin
Published: 2020-01-27T14:09:48.000Z
CVE-2013-4463 
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2013-4465 
Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-25T23:00:00.000Z
CVE-2013-4466 
Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4467 
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4468 
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-4469 
OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T18:00:00.000Z
CVE-2013-4470 
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T11:00:00.000Z
CVE-2013-4471 
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2013-4472 
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2013-4473 
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4474 
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4475 
Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-4476 
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-4477 
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-4478 
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4479 
lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T20:00:00.000Z
CVE-2013-4480 
Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4481 
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4482 
Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4483 
The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-04T11:00:00.000Z
CVE-2013-4484 
Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-01T01:00:00.000Z
CVE-2013-4485 
389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2013-4486 
Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging
Problem types: description: Remote code execution due to EL interpolation in logging
Affected products: vendor: Zanata
product: Zanata
Published: 2019-12-03T14:43:19.000Z
CVE-2013-4487 
Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.  NOTE: this issue is due to an incomplete fix for CVE-2013-4466.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4488 
libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2013-4489 
The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-17T20:00:00.000Z
CVE-2013-4490 
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4491 
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-4492 
Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-4494 
Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T18:00:00.000Z
CVE-2013-4495 
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4496 
Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T10:00:00.000Z
CVE-2013-4497 
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-4498 
The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new group, which causes the content to be "orphaned" and allows remote authenticated users with the "access content" permission to obtain sensitive information via vectors involving a rebuild access for the site or content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-17T20:00:00.000Z
CVE-2013-4499 
Cross-site scripting (XSS) vulnerability in the Bean module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the bean title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T19:00:00.000Z
CVE-2013-4500 
The Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote authenticated users with the "view any quiz results" or "view results for own quiz" permission to delete arbitrary results via the delete option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4501 
The default views in the Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote attackers to obtain sensitive quiz results via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2013-4502 
The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z