rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-4363 
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4364 
(1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2013-4365 
Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4366 
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T19:00:00.000Z
CVE-2013-4367 
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.
Problem types: description: Insecure Permissions
Affected products: vendor: ovirt-engine
product: ovirt-engine
Published: 2019-11-01T17:20:45.000Z
CVE-2013-4368 
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4369 
The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer dereference) by using the "@" character as the VIF rate configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4370 
The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4371 
Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4372 
Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T19:00:00.000Z
CVE-2013-4373 
The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-24T01:00:00.000Z
CVE-2013-4374 
An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.
Problem types: description: Malicious change set import due to insecure temporary file usage
Affected products: vendor: RHQ Mongo DB Drift Server
product: RHQ Mongo DB Drift Server
Published: 2019-11-04T21:16:52.000Z
CVE-2013-4375 
The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-19T18:00:00.000Z
CVE-2013-4376 
The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via unspecified vectors, related to the path to libx2go-server-db-sqlite3-wrapper.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T11:00:00.000Z
CVE-2013-4377 
Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4378 
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T16:00:00.000Z
CVE-2013-4379 
The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a poll via a direct request to the node's URL instead of the hashed URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T17:00:00.000Z
CVE-2013-4380 
Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T14:00:00.000Z
CVE-2013-4383 
Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-31T15:00:00.000Z
CVE-2013-4384 
Cross-site scripting (XSS) vulnerability in Google Site Search module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.10 for Drupal allows remote attackers to inject arbitrary web script or HTML by causing crafted data to be returned by the Google API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-4385 
Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T14:44:00.000Z
CVE-2013-4386 
Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-4387 
net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T10:00:00.000Z
CVE-2013-4388 
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2013-4389 
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T00:00:00.000Z
CVE-2013-4390 
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-24T01:00:00.000Z
CVE-2013-4391 
Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-4392 
systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-4393 
journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-4394 
The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-4395 
Simple Machines Forum (SMF) through 2.0.5 has XSS
Problem types: description: XSS
Affected products: vendor: SMF
product: SMF
Published: 2020-02-12T15:33:53.000Z
CVE-2013-4396 
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-10T10:00:00.000Z
CVE-2013-4397 
Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-17T23:00:00.000Z
CVE-2013-4399 
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-12T15:00:00.000Z
CVE-2013-4400 
virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T11:00:00.000Z
CVE-2013-4401 
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T18:00:00.000Z
CVE-2013-4402 
The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2013-4404 
cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended role restrictions and obtain sensitive information or perform privileged operations via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-4405 
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-4406 
The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions, which allows remote attackers to obtain sensitive information by reading a Quick Tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4407 
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T00:00:00.000Z
CVE-2013-4408 
Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-10T02:00:00.000Z
CVE-2013-4409 
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
Problem types: description: eval() vulnerability
Affected products: vendor: Python Software Foundation; Beanbag
product: Djblets
vendor: Python Software Foundation; Beanbag
product: Review Board
Published: 2019-11-04T20:45:44.000Z
CVE-2013-4410 
ReviewBoard: has an access-control problem in REST API
Problem types: description: access-control problems with REST API
Affected products: vendor: ReviewBoard
product: ReviewBoard
Published: 2019-12-02T17:36:52.000Z
CVE-2013-4411 
Review Board: URL processing gives unauthorized users access to review lists
Problem types: description: URL processing allows unauthorized users to view review lists
Affected products: vendor: Review Board
product: Review Board
Published: 2019-12-03T14:39:53.000Z
CVE-2013-4412 
slim has NULL pointer dereference when using crypt() method from glibc 2.17
Problem types: description: ptr dereference
Affected products: vendor: slim
product: slim
Published: 2019-11-04T12:44:54.000Z
CVE-2013-4413 
Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2013-4414 
Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-4415 
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software channels search; (2) end_year, (3) start_hour, (4) end_am_pm, (5) end_day, (6) end_hour, (7) end_minute, (8) end_month, (9) end_year, (10) optionScanDateSearch, (11) result_filter, (12) search_string, (13) show_as, (14) start_am_pm, (15) start_day, (16) start_hour, (17) start_minute, (18) start_month, (19) start_year, or (20) whereToSearch variable in an scap audit results search; (21) end_minute, (22) end_month, (23) end_year, (24) errata_type_bug, (25) errata_type_enhancement, (26) errata_type_security, (27) fineGrained, (28) list_1892635924_sortdir, (29) optionIssueDateSearch, (30) start_am_pm, (31) start_day, (32) start_hour, (33) start_minute, (34) start_month, (35) start_year, or (36) view_mode variable in an errata search; or (37) fineGrained variable in a systems search, related to PAGE_SIZE_LABEL_SELECTED.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T15:00:00.000Z
CVE-2013-4416 
The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-02T19:00:00.000Z
CVE-2013-4419 
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-4420 
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-20T16:00:00.000Z
CVE-2013-4421 
The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-25T23:00:00.000Z
CVE-2013-4422 
SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-23T15:00:00.000Z
CVE-2013-4423 
CloudForms stores user passwords in recoverable format
Problem types: description: user password stored in recoverable format
Affected products: vendor: CloudForms
product: CloudForms
Published: 2019-11-04T12:49:35.000Z
CVE-2013-4424 
Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T23:00:00.000Z
CVE-2013-4425 
The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" as the hardcoded password, which allows local users to obtain the private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T18:16:00.000Z
CVE-2013-4426 
pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple failed authentication attempts, which trigger a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4427 
pyxtrlock before 0.2 does not properly check the return values of the (1) xcb_grab_pointer and (2) xcb_grab_keyboard XCB library functions, which allows physically proximate attackers to gain access to the keyboard or mouse without unlocking the screen via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4428 
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-27T00:00:00.000Z
CVE-2013-4429 
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authenticated users to read arbitrary artefacts via the (1) artefact id in an upload action when creating a journal or (2) instconf_artefactid_selected[ID] parameter in an upload action when editing a block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4430 
Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2013-4431 
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticated users to modify arbitrary blocks via the bock id in an edit request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z