vdanen/rhvex-cve huggingface dataset:
CVE-2013-1512 (Moderate severity, published 2013-04-15)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.
Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-5802 (Important severity, published 2013-10-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.
CVE-2013-6668 (Moderate severity, published 2014-02-17)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Statement: Red Hat Product Security has rated this issue as having Low security impact in Red Hat Enterprise Linux OpenStack Platform. This issue is not currently planned to be addressed in a future security update.
CVE-2013-0616 (Critical severity, published 2013-01-07)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
CVE-2013-2555 (Critical severity, published 2013-03-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Statement: This issue affects the version of flash-plugin as shipped with Red Hat Enterprise Linux 5 and 6. Updates will be released as soon as they are made generally available by Adobe.
CVE-2013-1729 (Moderate severity, published 2013-09-16)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: The WebGL implementation in Mozilla Firefox before 24.0, when NVIDIA graphics drivers are used on Mac OS X, allows remote attackers to obtain desktop-screenshot data by reading from a CANVAS element.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
CVE-2013-3344 (Critical severity, published 2013-07-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via unspecified vectors.
CVE-2013-1379 (Critical severity, published 2013-04-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2013-4481 (Low severity, published 2013-11-19)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
Description: A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file.
CVE-2013-1683 (Critical severity, published 2013-06-24)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
CVE-2013-4317 (Low severity, published 2018-01-02)
CVSS score: 3.5 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CWE: CWE-200
Description: In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
CVE-2013-5855 (Moderate severity, published 2014-02-06)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79
Description: It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser.
CVE-2013-7491 (Low severity, published 2013-06-23)
CVSS score: 5.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
CWE: CWE-822
Description: An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
Statement: perl-DBI as shipped in Red Hat Enterprise Linux 8, rhscl-3 rh-perl526-perl-DBI and rhscl-3 rh-perl530-perl-DBI are notaffected by this flaw as the vulnerable code has already been patched in versions of perl-DBI shipped in these products.
CVE-2013-1953 (Low severity, published 2013-04-15)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
Description: Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
CVE-2013-0641 (Critical severity, published 2013-02-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
Statement: This issue affects the version of Adobe Acroread as shipped with Red Hat Enterprise Linux 5 and 6. Updates will be released as soon as they are made generally available by Adobe.
CVE-2013-0211 (Low severity, published 2013-03-24)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
Description: Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
CVE-2013-1050 (Low severity, published 2012-08-29)
CVSS score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Description: The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, which prevents the program from starting automatically after login and allows physically proximate attackers to bypass screen locking and access an unattended workstation.
Statement: Not vulnerable. This issue did not affect the versions of gnome-screensaver as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-5910 (Moderate severity, published 2014-01-13)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that CanonicalizerBase.java in the XML canonicalizer allows untrusted code to access mutable byte arrays.
CVE-2013-1695 (Moderate severity, published 2013-06-24)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
CVE-2013-4497 (Low severity, published 2012-10-29)
CVSS score: 3.6 (AV:N/AC:H/Au:S/C:P/I:P/A:N)
Description: The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
CVE-2013-6500 (Moderate severity, published 2015-02-03)
CVSS score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-829
Description: No description is available for this CVE.
CVE-2013-2113 (Moderate severity, published 2013-06-06)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CWE: CWE-285
Description: The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
CVE-2013-2056 (Moderate severity, published 2013-05-20)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Description: The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call.
CVE-2013-5793 (Low severity, published 2013-10-14)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.6.12 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5786.
Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-4182 (Important severity, published 2013-09-02)
CVSS score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-862
Description: app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
CVE-2013-1380 (Critical severity, published 2013-04-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1378.
CVE-2013-6445 (Moderate severity, published 2014-04-27)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack.
CVE-2013-1800 (Important severity, published 2013-01-13)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502
Description: The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
CVE-2013-5843 (Critical severity, published 2013-10-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2013-6629 (Moderate severity, published 2013-11-11)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-456
Description: The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVE-2013-5906 (Moderate severity, published 2014-01-13)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install, a different vulnerability than CVE-2013-5905.
CVE-2013-1416 (Moderate severity, published 2013-03-28)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-476
Description: The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.
Statement: This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 4 and 5.
CVE-2013-4244 (Moderate severity, published 2013-08-13)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-787
Description: The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.
CVE-2013-7038 (Important severity, published 2013-11-27)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CWE: CWE-125
Description: The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.
CVE-2013-1945 (Low severity, published 2014-09-16)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-829
Description: ruby193 uses an insecure LD_LIBRARY_PATH setting.
Statement: This issue affects the versions of Ruby 193 as shipped with Red Hat OpenShift Enterprise 1. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2013-2144 (Moderate severity, published 2013-06-09)
CVSS score: 2.9 (AV:A/AC:M/Au:N/C:N/I:N/A:P)
Description: Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.
CVE-2013-0179 (Low severity, published 2013-01-07)
CVSS score: 1.8 (AV:A/AC:H/Au:N/C:N/I:N/A:P)
Description: The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
CVE-2013-1768 (Important severity, published 2013-06-11)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502
Description: The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
CVE-2013-2001 (Moderate severity, published 2013-05-22)
CVSS score: 4.3 (AV:A/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: Buffer overflow in X.org libXxf86vm 1.1.2 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XF86VidModeGetGammaRamp function.
Statement: This issue affects the libXxf86vm package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/
CVE-2013-0196 (Moderate severity, published 2014-09-04)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-352
Description: A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
CVE-2013-2451 (Low severity, published 2013-06-17)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper enforcement of exclusive port binds when running on Windows, which allows attackers to bind to ports that are already in use.
CVE-2013-4356 (Low severity, published 2013-09-29)
CVSS score: 1 (AV:L/AC:H/Au:S/C:P/I:N/A:N)
CWE: CWE-401
Description: Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service (crash).
Statement: This issue does not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue does not affect the versions of the Linux kernel package as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as it does not have support for Xen hypervisor.
CVE-2013-5814 (Critical severity, published 2013-10-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.
CVE-2013-0745 (Critical severity, published 2013-01-07)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.
Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
CVE-2013-1857 (Moderate severity, published 2013-03-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79
Description: A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack.
CVE-2013-0315 (Moderate severity, published 2013-03-06)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Description: The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
CVE-2013-1912 (Moderate severity, published 2013-04-01)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
CVE-2013-0250 (Moderate severity, published 2013-01-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
Statement: Not vulnerable. This issue did not affect the version of corosync as shipped with Red Hat Enterprise Linux 6.
CVE-2013-4213 (Important severity, published 2013-06-26)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-384
Description: Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
CVE-2013-6384 (Low severity, published 2013-11-21)
CVSS score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Description: (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
CVE-2013-6469 (Important severity, published 2014-04-08)
CVSS score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Description: JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression.  NOTE: some of these details are obtained from third party information.
Statement: This issue does not affect RTgov as shipped with Red Hat JBoss Fuse Service Works 6. It may affect earlier versions of the upstream JBoss Overlord RTGov project.

In Red Hat JBoss Fuse Service Works 6, this flaw is mitigated by configuration options that either remove the vulnerable interface, or constrain it using a Java Security Manager policy. These options are documented in the Installation and Security Guides for the product.
CVE-2013-5615 (Moderate severity, published 2013-12-09)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbrid shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2013-2095 (Important severity, published 2015-05-12)
CVSS score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-78
Description: rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection