rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-0297 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-0298 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-0299 
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T17:00:00.000Z
CVE-2013-0300 
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T17:00:00.000Z
CVE-2013-0301 
Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T17:00:00.000Z
CVE-2013-0302 
Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T15:00:00.000Z
CVE-2013-0303 
Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-23T15:00:00.000Z
CVE-2013-0304 
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php.  NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T15:00:00.000Z
CVE-2013-0305 
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-0306 
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2013-0307 
Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-0308 
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-08T21:00:00.000Z
CVE-2013-0309 
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-22T00:00:00.000Z
CVE-2013-0310 
The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-22T00:00:00.000Z
CVE-2013-0311 
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-22T00:00:00.000Z
CVE-2013-0312 
389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-13T20:48:00.000Z
CVE-2013-0313 
The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-22T00:00:00.000Z
CVE-2013-0314 
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-12T22:00:00.000Z
CVE-2013-0315 
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-12T22:00:00.000Z
CVE-2013-0316 
The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0317 
Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0318 
The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0319 
Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0320 
Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0321 
Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0322 
Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0323 
Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0324 
Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0325 
Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0326 
OpenStack nova base images permissions are world readable
Problem types: description: images permissions world readable
Affected products: vendor: openstack-nova
product: openstack-nova
Published: 2019-12-05T16:09:36.000Z
CVE-2013-0327 
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0328 
Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0329 
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0330 
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0331 
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0332 
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-20T15:00:00.000Z
CVE-2013-0333 
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-30T11:00:00.000Z
CVE-2013-0334 
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T14:00:00.000Z
CVE-2013-0335 
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-22T21:00:00.000Z
CVE-2013-0336 
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-03T23:00:00.000Z
CVE-2013-0337 
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-27T00:00:00.000Z
CVE-2013-0338 
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-0339 
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z
CVE-2013-0340 
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Problem types: description: n/a
Affected products: default_status: unaffected
Published: 2014-01-21T18:00:00.000Z
CVE-2013-0342 
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
Problem types: description: Cryptography
Affected products: vendor: pyrad
product: pyrad
Published: 2019-12-09T20:55:36.000Z
CVE-2013-0343 
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2013-0345 
varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0346 
Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-15T00:00:00.000Z
CVE-2013-0347 
The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T11:00:00.000Z
CVE-2013-0348 
thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2013-0349 
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2013-0350 
tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2013-0351 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T00:00:00.000Z
CVE-2013-0352 
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Content Management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0353 
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 allows remote attackers to affect integrity via unknown vectors related to Enterprise Configuration Management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0354 
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Policy Framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0355 
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0356 
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0357 
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z
CVE-2013-0358 
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Resource Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T01:30:00.000Z