rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6468 
JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T14:00:00.000Z
CVE-2013-6469 
JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T14:00:00.000Z
CVE-2013-6470 
The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2013-6472 
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2013-6473 
Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-6474 
Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-6475 
Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-6476 
The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2013-6477 
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6478 
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6479 
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6480 
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T18:00:00.000Z
CVE-2013-6481 
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2013-6482 
Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2013-6483 
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6484 
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6485 
Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6486 
gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3185.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T15:00:00.000Z
CVE-2013-6487 
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2013-6489 
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2013-6490 
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2013-6491 
The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-02T00:00:00.000Z
CVE-2013-6492 
The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T15:00:00.000Z
CVE-2013-6493 
The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2013-6494 
fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of service (prevention of system updates).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T01:00:00.000Z
CVE-2013-6495 
JBossWeb Bayeux has reflected XSS
Problem types: description: Reflected Cross-Site Scripting (XSS)
Affected products: vendor: JBossWeb Bayeux
product: JBossWeb Bayeux
Published: 2019-12-11T13:48:58.000Z
CVE-2013-6496 
Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2013-6497 
clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2013-6501 
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2013-6617 
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2013-6618 
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows remote authenticated users to execute arbitrary commands via the rsargs parameter in an exec action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T20:00:00.000Z
CVE-2013-6621 
Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6622 
Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the movement of a media element between documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6623 
The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order, rather than transitive dependency order, for layout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6624 
Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6625 
Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6626 
The WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 31.0.1650.48 does not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6627 
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6628 
net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-13T15:00:00.000Z
CVE-2013-6629 
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T20:00:00.000Z
CVE-2013-6630 
The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T20:00:00.000Z
CVE-2013-6631 
Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-15T20:00:00.000Z
CVE-2013-6632 
Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-16T15:00:00.000Z
CVE-2013-6634 
The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6635 
Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing of the DOM tree, related to CompositeEditCommand.cpp and ReplaceSelectionCommand.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6636 
The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6637 
Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6638 
Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1) Runtime_TypedArrayInitialize and (2) Runtime_TypedArrayInitializeFromArrayLike functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6639 
The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6640 
The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-07T00:00:00.000Z
CVE-2013-6641 
Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of the past names map of a FORM element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6642 
Google Chrome through 32.0.1700.23 on Android allows remote attackers to spoof the address bar via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6643 
The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6644 
Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6645 
Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/web_contents/web_contents_view_aura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving certain print-preview and tab-switch actions that interact with a speech input element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6646 
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T11:00:00.000Z
CVE-2013-6647 
A use-after-free in AnimationController::endAnimationUpdate in Google Chrome.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T19:00:00.000Z
CVE-2013-6648 
SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2013-6649 
Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-28T11:00:00.000Z
CVE-2013-6650 
The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-28T11:00:00.000Z
CVE-2013-6652 
Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks for .. (dot dot) sequences or (2) lack of use of the \\?\ protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-24T02:00:00.000Z
CVE-2013-6653 
Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to the color chooser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-24T02:00:00.000Z