rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-1059 
net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T17:00:00.000Z
CVE-2013-1060 
A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-25T10:00:00.000Z
CVE-2013-1061 
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1062 
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1063 
usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1064 
apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1065 
backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1066 
language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-03T21:00:00.000Z
CVE-2013-1067 
Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-25T23:00:00.000Z
CVE-2013-1068 
The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-19T15:00:00.000Z
CVE-2013-1069 
Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2013-1070 
Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2013-1079 
Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T10:00:00.000Z
CVE-2013-1080 
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T10:00:00.000Z
CVE-2013-1081 
Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-11T21:00:00.000Z
CVE-2013-1082 
Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T10:00:00.000Z
CVE-2013-1083 
Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager (aka IDM) Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T10:00:00.000Z
CVE-2013-1084 
Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-1085 
Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier, and Novell Messenger 2.1.x and 2.2.x before 2.2.2, allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T10:00:00.000Z
CVE-2013-1086 
Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-19T10:00:00.000Z
CVE-2013-1087 
Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-15T20:00:00.000Z
CVE-2013-1088 
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-24T10:00:00.000Z
CVE-2013-1090 
The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-06T17:00:00.000Z
CVE-2013-1091 
Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T18:00:00.000Z
CVE-2013-1092 
Multiple unquoted Windows search path vulnerabilities in Novell ZENworks Desktop Management (ZDM) 7 through 7.1 might allow local users to gain privileges via a Trojan horse "program" file in the C: folder, related to an attempted launch of (1) ZenRem32.exe or (2) wm.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-05T10:00:00.000Z
CVE-2013-1093 
Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-1094 
Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-1095 
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-1096 
Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-1097 
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onload event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-17T10:00:00.000Z
CVE-2013-1100 
The HTTP server in Cisco IOS on Catalyst switches does not properly handle TCP socket events, which allows remote attackers to cause a denial of service (device crash) via crafted packets on TCP port (1) 80 or (2) 443, aka Bug ID CSCuc53853.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T23:00:00.000Z
CVE-2013-1102 
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, 7.1 and 7.2 before 7.2.110.0, and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets, aka Bug ID CSCtx80743.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T21:00:00.000Z
CVE-2013-1103 
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (Access Point reload) via crafted SIP packets, aka Bug ID CSCts87659.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T21:00:00.000Z
CVE-2013-1104 
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T21:00:00.000Z
CVE-2013-1105 
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T21:00:00.000Z
CVE-2013-1107 
The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-06T11:00:00.000Z
CVE-2013-1108 
Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-21T21:00:00.000Z
CVE-2013-1109 
Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T15:00:00.000Z
CVE-2013-1110 
Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-21T21:00:00.000Z
CVE-2013-1111 
The Cisco ATA 187 Analog Telephone Adaptor with firmware 9.2.1.0 and 9.2.3.1 before ES build 4 does not properly implement access control, which allows remote attackers to execute operating-system commands via vectors involving a session on TCP port 7870, aka Bug ID CSCtz67038.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T23:00:00.000Z
CVE-2013-1112 
Cisco Carrier Routing System (CRS) allows remote attackers to cause a denial of service (packet loss) via short malformed packets that trigger inefficient processing, aka Bug ID CSCud79136.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-31T11:00:00.000Z
CVE-2013-1113 
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via a crafted parameter value, aka Bug ID CSCue21042.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-31T11:00:00.000Z
CVE-2013-1114 
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud87527.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T23:00:00.000Z
CVE-2013-1115 
Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ARF file, aka Bug IDs CSCue74118, CSCub28371, CSCud23401, and CSCud31109.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-06T10:00:00.000Z
CVE-2013-1116 
Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted ARF file, aka Bug IDs CSCue74147 and CSCub28383.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-06T10:00:00.000Z
CVE-2013-1117 
Buffer overflow in the exception handler in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCuc27639.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-06T10:00:00.000Z
CVE-2013-1118 
Stack-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCuc27645.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-06T10:00:00.000Z
CVE-2013-1119 
Buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DHT index value in JPEG data within a WRF file, aka Bug ID CSCuc24503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-06T10:00:00.000Z
CVE-2013-1120 
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-06T11:00:00.000Z
CVE-2013-1121 
The regex engine in the BGP implementation in Cisco NX-OS, when a complex regular expression is configured for inbound routes, allows remote attackers to cause a denial of service (device reload) via a crafted AS path set, aka Bug ID CSCuf49554.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-19T18:00:00.000Z
CVE-2013-1122 
Cisco NX-OS on the Nexus 7000, when a certain Overlay Transport Virtualization (OTV) configuration is used, allows remote attackers to cause a denial of service (M1-Series module reload) via crafted packets, aka Bug ID CSCud15673.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T23:00:00.000Z
CVE-2013-1123 
Multiple cross-site scripting (XSS) vulnerabilities in the server in Cisco Unified MeetingPlace 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuc65411 and CSCue18706.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-15T11:00:00.000Z
CVE-2013-1124 
The Cisco Network Admission Control (NAC) agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine (ISE) server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T23:00:00.000Z
CVE-2013-1125 
The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution (LMS), Prime Network Control System, Quad, Context Directory Agent, Prime Collaboration, Unified Provisioning Manager, and Network Services Manager does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCue46001, CSCud95790, CSCue46021, CSCue46025, CSCue46023, CSCue46058, CSCue46013, CSCue46031, CSCue46035, and CSCue46042.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-19T23:00:00.000Z
CVE-2013-1128 
Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuc64903.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-15T11:00:00.000Z
CVE-2013-1129 
Memory leak in Cisco Unity Connection 9.x allows remote attackers to cause a denial of service (memory consumption and process crash) by sending many TCP requests, aka Bug ID CSCud59736.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-19T23:00:00.000Z
CVE-2013-1130 
Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-20T16:00:00.000Z
CVE-2013-1131 
Cisco Small Business Wireless Access Points WAP200, WAP2000, WAP200E, and WET200 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SSID that is not properly handled during a site survey, aka Bug IDs CSCua86182, CSCua91196, CSCud36155, and CSCua86190.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T23:00:00.000Z
CVE-2013-1132 
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) IptAccountMgmt, (2) IptFeatureConfigTemplateMgmt, (3) IptFeatureDisplayPolicyMgmt, or (4) IptProviderMgmt page, aka Bug IDs CSCud69972, CSCud70193, and CSCud70261.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T21:00:00.000Z
CVE-2013-1133 
Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports, aka Bug ID CSCtx43337.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-27T21:00:00.000Z
CVE-2013-1134 
The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-27T21:00:00.000Z