vdanen/rhvex-cve huggingface dataset:
CVE-2013-1571 (Moderate severity, published 2013-06-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.
CVE-2013-1988 (Moderate severity, published 2013-05-22)
CVSS score: 4.3 (AV:A/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: Multiple integer overflows in X.org libXRes 1.0.6 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XResQueryClients and (2) XResQueryClientResources functions.
Statement: This issue affects the libXRes package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/
CVE-2013-2218 (Important severity, published 2013-06-30)
CVSS score: 6.8 (AV:A/AC:H/Au:N/C:C/I:C/A:C)
Description: Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command.
Statement: Not vulnerable.

This issue did not affect the versions of libvirt package as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-4636 (Moderate severity, published 2013-05-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
Statement: Not Vulnerable. This issue does not affect the version of php as shipped with Red Hat Enterprise Linux 5 and 6. This issue does not affect the version of php53 as shipped with Red Hat Enterprise Linux 5.
CVE-2013-1789 (Low severity, published 2013-01-09)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions.
CVE-2013-1623 (Moderate severity, published 2013-02-03)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 or 6. The packages use OpenSSL and not yaSSL.
CVE-2013-0198 (Low severity, published 2013-01-10)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Description: Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.
Statement: Not vulnerable. This issue did not affect the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-7348 (Moderate severity, published 2013-11-18)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.
Statement: Not vulnerable.

This issued does not affect Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.
CVE-2013-5375 (Moderate severity, published 2013-11-04)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.
CVE-2013-4564 (Moderate severity, published 2013-11-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet.
CVE-2013-1766 (Moderate severity, published 2013-02-24)
CVSS score: 3.5 (AV:L/AC:H/Au:S/C:P/I:P/A:P)
Description: libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
Statement: Not vulnerable.

This issue did not affect the versions of the libvirt package as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-7061 (Low severity, published 2013-12-09)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-285
Description: Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2013-2776 (Low severity, published 2013-02-26)
CVSS score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Description: sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
CVE-2013-2058 (Low severity, published 2012-12-21)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.
Statement: This issue does not affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with
Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2
may address this issue.
CVE-2013-4925 (Low severity, published 2013-07-25)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.
Statement: Not Vulnerable. This issue does not affect the version of wireshark, as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-0435 (Moderate severity, published 2013-01-31)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."
CVE-2013-4476 (Moderate severity, published 2013-11-10)
CVSS score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Description: Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Statement: Not vulnerable. This issue did not affect the versions of samba or samba3x as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for acting as an Active Directory Domain Controller.
CVE-2013-1674 (Critical severity, published 2013-05-13)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.
CVE-2013-4533 (Moderate severity, published 2013-12-02)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
Statement: Not vulnerable.

This issue does not affect the versions of kvm package as shipped with
Red Hat Enterprise Linux 5.

This issue does not affect the versions of qemu-kvm package as shipped
with Red Hat Enterprise Linux 6
CVE-2013-4163 (Moderate severity, published 2013-06-30)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.
CVE-2013-5772 (Low severity, published 2013-10-14)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat.
CVE-2013-1418 (Moderate severity, published 2013-11-03)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request.
CVE-2013-5908 (Low severity, published 2014-01-13)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Description: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote attackers to affect availability via unknown vectors related to Error Handling.
CVE-2013-2234 (Low severity, published 2013-06-25)
CVSS score: 1.7 (AV:L/AC:L/Au:S/C:P/I:N/A:N)
Description: The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue. This issue has been addressed for Red Hat Enterprise Linux 5 via RHSA-2013:1166 (https://rhn.redhat.com/errata/RHSA-2013-1166.html).
CVE-2013-2721 (Critical severity, published 2013-05-13)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.
CVE-2013-7489 (Moderate severity, published 2020-05-13)
CVSS score: 5.7 (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L)
CWE: CWE-502
Description: A flaw was found in python-beaker, where it is affected by the deserialization of untrusted data. This flaw allows an attacker to enter malicious payloads into the cache database (for example, if they are on the network and have credentials for the database), to perform remote code execution on the machine running Beaker, due to the deserialization of data from the cache database by Pickle.
Mitigation: Implementing proper access control on the Beaker cache database, to prevent unauthorized writes into the database, will mitigate exploitation of this flaw. This flaw also cannot be triggered if the Cache functionality of Beaker is not used. When using the Session feature of Beaker, use the signing functionality to verify the integrity of the data retrieved from the database before deserialization.
CVE-2013-3560 (Low severity, published 2013-05-16)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Statement: Not Vulnerable. This issue does not affect the version of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-0423 (Moderate severity, published 2013-01-31)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
CVE-2013-4933 (Low severity, published 2013-07-25)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
CVE-2013-7470 (Moderate severity, published 2013-10-18)
CVSS score: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-400
Description: cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
CVE-2013-2737 (Moderate severity, published 2013-05-13)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: A JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to obtain sensitive information via unspecified vectors.
CVE-2013-5676 (Low severity, published 2013-12-05)
CVSS score: 4 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
Description: The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
Statement: Not Vulnerable. The SonarQube plug-in for Jenkins is not shipped by Red Hat.
CVE-2013-2449 (Moderate severity, published 2013-06-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to GnomeFileTypeDetector and a missing check for read permissions for a path.
CVE-2013-1635 (Moderate severity, published 2013-02-06)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Description: ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
Statement: We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php
CVE-2013-4122 (Moderate severity, published 2013-07-11)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.
Statement: Not Vulnerable. This issue does not affect the version of cyrus-sasl package as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-0618 (Critical severity, published 2013-01-07)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0614.
CVE-2013-2275 (Moderate severity, published 2013-03-11)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
Description: The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
CVE-2013-0248 (Low severity, published 2013-03-05)
CVSS score: 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)
CWE: CWE-552
Description: The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Statement: Red Hat Enterprise Linux 5 and Red Hat Satellite Server 5 are now in Production 3 and Production 2 Phases of the support and maintenance life cycle respectively. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/ and the Red Hat Satellite and Proxy Server Life Cycle: https://access.redhat.com/support/policy/updates/satellite.

Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/.

This issue affects the versions of commons-fileupload as shipped with Red Hat Enterprise Virtualization Manager 3 and Red Hat JBoss Fuse Service Works 6. Red Hat Product Security has rated this issue as having Low security impact. A future update to these products may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Mitigation: By default, the system wide temporary directory is configured as the repository to use when uploading files. Setting the repository to another location will mitigate this vulnerability.
CVE-2013-6373 (Low severity, published 2013-11-20)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Description: The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
Statement: Not affected. This issue did not affect Jenkins as shipped with various Red Hat products, as they do not include the Jenkins Exclusion plugin.
CVE-2013-3556 (Low severity, published 2013-05-16)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Statement: Not Vulnerable. This issue does not affect the version of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-4293 (Low severity, published 2013-10-20)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Description: The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files.