rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-0173 
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0174 
The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0175 
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-0176 
The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T23:11:00.000Z
CVE-2013-0177 
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T15:00:00.000Z
CVE-2013-0178 
Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.
Problem types: description: Other
Affected products: vendor: Redis Labs
product: Redis
Published: 2019-11-01T18:25:27.000Z
CVE-2013-0179 
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T21:00:00.000Z
CVE-2013-0180 
Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.
Problem types: description: Other
Affected products: vendor: Redis Labs
product: Redis
Published: 2019-11-01T18:25:30.000Z
CVE-2013-0181 
Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0182 
The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-27T21:00:00.000Z
CVE-2013-0183 
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T02:00:00.000Z
CVE-2013-0184 
Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T02:00:00.000Z
CVE-2013-0185 
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T19:00:00.000Z
CVE-2013-0186 
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ManageIQ EVM
product: ManageIQ EVM
vendor: Red Hat
product: Red Hat CloudForms 3.0
Published: 2019-11-01T18:38:38.000Z
CVE-2013-0187 
Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0189 
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request.  NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T20:00:00.000Z
CVE-2013-0190 
The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0191 
libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-03T14:00:00.000Z
CVE-2013-0192 
File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.
Problem types: description: file exposure
Affected products: vendor: SMF
product: SMF
Published: 2020-02-07T13:29:07.000Z
CVE-2013-0193 
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
Problem types: description: Cross-Site Scripting
Affected products: vendor: piwik
product: piwik
Published: 2019-11-20T14:26:54.000Z
CVE-2013-0194 
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
Problem types: description: Cross-Site Scripting
Affected products: vendor: piwik
product: piwik
Published: 2019-11-20T14:30:12.000Z
CVE-2013-0195 
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
Problem types: description: Cross-Site Scripting
Affected products: vendor: piwik
product: piwik
Published: 2019-11-20T14:31:59.000Z
CVE-2013-0196 
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: OpenShift
product: OpenShift Enterprise
Published: 2019-12-30T21:17:02.000Z
CVE-2013-0197 
Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2013-0198 
Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2013-0199 
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2013-0200 
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-06T20:00:00.000Z
CVE-2013-0201 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-18T14:00:00.000Z
CVE-2013-0202 
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ownCloud
product: ownCloud
Published: 2019-11-22T18:53:38.000Z
CVE-2013-0203 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/calendar/ajax/event/new.php or (2) url parameter to apps/bookmarks/ajax/addBookmark.php.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ownCloud
product: ownCloud Server
Published: 2019-11-22T18:53:44.000Z
CVE-2013-0204 
settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-04T14:00:00.000Z
CVE-2013-0205 
Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0206 
Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0207 
Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0208 
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T16:00:00.000Z
CVE-2013-0209 
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-23T01:00:00.000Z
CVE-2013-0210 
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0211 
Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-30T20:00:00.000Z
CVE-2013-0212 
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T21:00:00.000Z
CVE-2013-0213 
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T20:00:00.000Z
CVE-2013-0214 
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T20:00:00.000Z
CVE-2013-0215 
oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-07T02:00:00.000Z
CVE-2013-0216 
The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2013-0217 
Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2013-0218 
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T23:11:00.000Z
CVE-2013-0219 
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T19:00:00.000Z
CVE-2013-0220 
The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T19:00:00.000Z
CVE-2013-0221 
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-0222 
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-0223 
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-0224 
The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0225 
Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0226 
The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0227 
Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-19T14:00:00.000Z
CVE-2013-0228 
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T11:00:00.000Z
CVE-2013-0229 
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-31T21:00:00.000Z
CVE-2013-0230 
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-31T21:00:00.000Z
CVE-2013-0231 
The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0232 
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-20T15:00:00.000Z
CVE-2013-0233 
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2013-0234 
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-02T20:00:00.000Z
CVE-2013-0235 
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z
CVE-2013-0236 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-08T20:00:00.000Z