cpe:/a:microsoft:.net_framework:1.0:sp3 cpe:/a:microsoft:.net_framework:1.1:sp1 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:.net_framework:4.5

CVE-2013-0001

2013-01-09T13:09:37.993-05:00

2019-02-26T09:04:00.993-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MS MS13-004 The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unmanaged memory location, aka "System Drawing Information Disclosure Vulnerability."

CVE-2013-0002

2013-01-09T13:09:39.977-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-004 MLIST [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages improper counting of objects during a memory copy operation, aka "WinForms Buffer Overflow Vulnerability."

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:.net_framework:4.5

CVE-2013-0003

2013-01-09T13:09:40.040-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-004 Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a missing array-size check during a memory copy operation, aka "S.DS.P Buffer Overflow Vulnerability."

CVE-2013-0004

2013-01-09T13:09:40.087-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-004 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."

cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5:sp1 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:management_odata_iis_extension:-

CVE-2013-0005

2013-01-09T13:09:40.133-05:00

2019-02-26T09:04:00.993-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-007 The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service (resource consumption and daemon restart) via crafted values in HTTP requests, aka "Replace Denial of Service Vulnerability."

cpe:/a:microsoft:expression_web::sp1 cpe:/a:microsoft:expression_web:2 cpe:/a:microsoft:groove_server:2007:sp2 cpe:/a:microsoft:groove_server:2007:sp3 cpe:/a:microsoft:office:2003:sp3 cpe:/a:microsoft:office:2007:sp2 cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office_compatibility_pack::sp2 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:sharepoint_server:2007:sp2 cpe:/a:microsoft:sharepoint_server:2007:sp3 cpe:/a:microsoft:word_viewer cpe:/a:microsoft:xml_core_services:3.0 cpe:/a:microsoft:xml_core_services:4.0 cpe:/a:microsoft:xml_core_services:5.0 cpe:/a:microsoft:xml_core_services:6.0 cpe:/o:microsoft:windows_7:- cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_8:-:-:x64 cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_server_2008:-:sp2:itanium cpe:/o:microsoft:windows_server_2008:-:sp2:x64 cpe:/o:microsoft:windows_server_2008:r2:-:x64 cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_vista::sp2:x64 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_xp:-:sp2:x64

CVE-2013-0006

2013-01-09T13:09:40.163-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-002 Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."

CVE-2013-0007

2013-01-09T13:09:40.227-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-002 Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."

cpe:/o:microsoft:windows_7:::x64 cpe:/o:microsoft:windows_7:::x86 cpe:/o:microsoft:windows_7::sp1:x86 cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_8:-:-:x64 cpe:/o:microsoft:windows_8:-:-:x86 cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_server_2008::sp2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_server_2008:-:sp2:itanium cpe:/o:microsoft:windows_server_2008:r2::itanium cpe:/o:microsoft:windows_server_2008:r2::x64 cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_vista::sp2:x64

CVE-2013-0008

2013-01-09T13:09:40.320-05:00

2018-10-12T18:03:32.047-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov EXPLOIT-DB 24485 BID 57135 CERT TA13-008A MS MS13-005 win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle window broadcast messages, which allows local users to gain privileges via a crafted application, aka "Win32k Improper Message Handling Vulnerability."

cpe:/a:microsoft:system_center_operations_manager:2007:r2 cpe:/a:microsoft:system_center_operations_manager:2007:sp1

CVE-2013-0009

2013-01-09T13:09:40.397-05:00

2018-10-12T18:03:32.673-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-008A MS MS13-003 Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0010.

cpe:/a:microsoft:system_center_operations_manager:2007:r2 cpe:/a:microsoft:system_center_operations_manager:2007:sp1

CVE-2013-0010

2013-01-09T13:09:40.460-05:00

2018-10-12T18:03:32.987-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

CVE-2013-0011

2013-01-09T13:09:40.493-05:00

2018-10-12T18:03:33.297-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-008A MS MS13-001 The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted print job, aka "Windows Print Spooler Components Vulnerability."

CVE-2013-0012

2017-05-11T10:29:23.857-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/o:microsoft:windows_7:::x64 cpe:/o:microsoft:windows_7:::x86 cpe:/o:microsoft:windows_7::sp1:x64 cpe:/o:microsoft:windows_7::sp1:x86 cpe:/o:microsoft:windows_8:-:-:x64 cpe:/o:microsoft:windows_8:-:-:x86 cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_server_2008::r2:itanium cpe:/o:microsoft:windows_server_2008::r2:x64 cpe:/o:microsoft:windows_server_2008::sp2:itanium cpe:/o:microsoft:windows_server_2008::sp2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_server_2008:r2:sp1:itanium cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_vista::sp2:x64

CVE-2013-0013

2013-01-09T13:09:40.540-05:00

2018-10-12T18:03:33.610-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-008A MS MS13-006 The SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle encrypted packets, which allows man-in-the-middle attackers to conduct SSLv2 downgrade attacks against (1) SSLv3 sessions or (2) TLS sessions by intercepting handshakes and injecting content, aka "Microsoft SSL Version 3 and TLS Protocol Security Feature Bypass Vulnerability."

CVE-2013-0014

2017-05-11T10:29:23.870-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2013-0015

2013-02-13T07:04:11.697-05:00

2018-10-12T18:03:33.940-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS encoding, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers cross-domain scrolling events, aka "Shift JIS Character Encoding Vulnerability."

CVE-2013-0016

2017-05-11T10:29:23.903-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0017

2017-05-11T10:29:23.917-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2013-0018

2013-02-13T07:04:11.743-05:00

2018-10-12T18:03:34.250-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SetCapture Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0019

2013-02-13T07:04:11.773-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.skylined.nl/20161202001.html CERT TA13-043B MS MS13-009 EXPLOIT-DB 40879 Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer COmWindowProxy Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:9

CVE-2013-0020

2013-02-13T07:04:11.820-05:00

2018-10-12T18:03:35.220-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkup Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0021

2013-02-13T07:04:11.867-05:00

2018-10-12T18:03:35.533-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer vtable Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:9

CVE-2013-0022

2013-02-13T07:04:11.900-05:00

2018-10-12T18:03:35.847-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0023

2013-02-13T07:04:11.947-05:00

2018-10-12T18:03:36.173-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CDispNode Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/o:microsoft:windows_server_2008::r2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_server_2008:r2:sp1:x64 cpe:/o:microsoft:windows_vista::sp2:x64

CVE-2013-0024

2013-02-13T07:04:11.993-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer pasteHTML Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:8

CVE-2013-0025

2013-02-13T07:04:12.040-05:00

2018-10-12T18:03:36.907-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-009 Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SLayoutRun Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:9

CVE-2013-0026

2013-02-13T07:04:12.087-05:00

2018-10-12T18:03:37.220-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0027

2013-02-13T07:04:12.117-05:00

2018-10-12T18:03:37.547-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2013-0028

2013-02-13T07:04:12.167-05:00

2018-10-12T18:03:37.860-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9

CVE-2013-0029

2013-02-13T07:04:12.197-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0030

2013-02-13T07:04:12.243-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-010 The Vector Markup Language (VML) implementation in Microsoft Internet Explorer 6 through 10 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via a crafted web site, aka "VML Memory Corruption Vulnerability."

CVE-2013-0031

2017-05-11T10:29:23.950-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0032

2017-05-11T10:29:23.967-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0033

2017-05-11T10:29:23.997-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0034

2017-05-11T10:29:24.013-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0035

2017-05-11T10:29:24.027-04:00

2017-05-11T10:29:24.043-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0036

2017-05-11T10:29:24.060-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0037

2017-05-11T10:29:24.077-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0038

2017-05-11T10:29:24.107-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0039

2017-05-11T10:29:24.120-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0040

2017-05-11T10:29:24.137-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0041

2017-05-11T10:29:24.167-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0042

2017-05-11T10:29:24.183-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0043

2017-05-11T10:29:24.217-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0044

2017-05-11T10:29:24.230-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0045

2017-05-11T10:29:24.263-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0046

2017-05-11T10:29:24.277-04:00

2017-05-11T10:29:24.293-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0047

2017-05-11T10:29:24.310-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0048

2017-05-11T10:29:24.327-04:00

2017-05-11T10:29:24.340-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0049

2017-05-11T10:29:24.357-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0050

2017-05-11T10:29:24.370-04:00

2017-05-11T10:29:24.387-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0051

2017-05-11T10:29:24.403-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0052

2017-05-11T10:29:24.417-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0053

2017-05-11T10:29:24.450-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0054

2017-05-11T10:29:24.467-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0055

2017-05-11T10:29:24.497-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0056

2017-05-11T10:29:24.513-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0057

2017-05-11T10:29:24.527-04:00

2017-05-11T10:29:24.543-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0058

2017-05-11T10:29:24.560-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0059

2017-05-11T10:29:24.590-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0060

2017-05-11T10:29:24.607-04:00

2017-05-11T10:29:24.620-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0061

2017-05-11T10:29:24.700-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0062

2017-05-11T10:29:24.717-04:00

2017-05-11T10:29:24.730-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0063

2017-05-11T10:29:24.747-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0064

2017-05-11T10:29:24.777-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0065

2017-05-11T10:29:24.793-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0066

2017-05-11T10:29:24.827-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0067

2017-05-11T10:29:24.840-04:00

2017-05-11T10:29:24.857-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0068

2017-05-11T10:29:24.873-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0069

2017-05-11T10:29:24.903-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0070

2017-05-11T10:29:24.917-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0071

2017-05-11T10:29:24.950-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0072

2017-05-11T10:29:24.980-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.0 cpe:/a:microsoft:.net_framework:4.5

CVE-2013-0073

2013-02-13T07:04:12.290-05:00

2019-02-26T09:04:00.993-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-015 The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during object creation, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "WinForms Callback Elevation Vulnerability."

cpe:/a:microsoft:silverlight:5.0.60401.0 cpe:/a:microsoft:silverlight:5.0.60818.0:rc cpe:/a:microsoft:silverlight:5.0.61118.0

CVE-2013-0074

2013-03-12T20:55:01.137-04:00

2019-02-26T09:04:00.853-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-071A MS MS13-022 Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

CVE-2013-0075

2013-02-13T07:04:12.320-05:00

2018-10-12T18:03:40.220-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-018 The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (reboot) via a crafted packet that terminates a TCP connection, aka "TCP FIN WAIT Vulnerability."

CVE-2013-0076

2013-02-13T07:04:12.367-05:00

2018-10-12T18:03:40.597-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-019 The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Reference Count Vulnerability."

cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008::sp2:itanium cpe:/o:microsoft:windows_server_2008::sp2:x64 cpe:/o:microsoft:windows_server_2008::sp2:x86 cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_vista::sp2:x64 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_xp:-:sp2:x64

CVE-2013-0077

2013-02-13T07:04:12.417-05:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-043B MS MS13-011 Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via crafted media content in (1) a media file, (2) a media stream, or (3) a Microsoft Office document, aka "Media Decompression Vulnerability."

cpe:/a:microsoft:windows_defender

CVE-2013-0078

2013-04-09T18:55:01.063-04:00

2018-10-12T18:03:41.237-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-100A MS MS13-034 The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows local users to gain privileges via a crafted application, aka "Microsoft Antimalware Improper Pathname Vulnerability."

cpe:/a:microsoft:office_filter_pack:2010:sp1:x64 cpe:/a:microsoft:office_filter_pack:2010:sp1:x86 cpe:/a:microsoft:visio:2010:sp1:x64 cpe:/a:microsoft:visio:2010:sp1:x86 cpe:/a:microsoft:visio_viewer:2010:sp1:x64 cpe:/a:microsoft:visio_viewer:2010:sp1:x86

CVE-2013-0079

2013-03-12T20:55:01.167-04:00

2018-10-12T18:03:41.580-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT-VN VU#851777 CERT TA13-071A IDEFENSE 20130312 Microsoft Office Visio Viewer ActiveX Type Confusion Vulnerability MS MS13-023 Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp1

CVE-2013-0080

2013-03-12T20:55:01.183-04:00

2018-10-12T18:03:42.033-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CERT TA13-071A MS MS13-024 Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_foundation:2010:sp2 cpe:/a:microsoft:sharepoint_foundation:2013 cpe:/a:microsoft:sharepoint_portal_server:2003:sp3 cpe:/a:microsoft:sharepoint_server:2007:sp3 cpe:/a:microsoft:sharepoint_server:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013 cpe:/a:microsoft:sharepoint_services:2.0 cpe:/a:microsoft:sharepoint_services:3.0

CVE-2013-0081

2013-09-11T10:03:47.987-04:00

2018-10-12T18:03:42.347-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CERT TA13-253A MS MS13-067 Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL, aka "SharePoint Denial of Service Vulnerability."

cpe:/a:microsoft:office:2003:sp3 cpe:/a:microsoft:office:2007:sp3

CVE-2013-0082

2013-11-12T19:55:02.807-05:00

2018-10-12T18:03:42.657-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-317A MS MS13-091 Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "WPD File Format Memory Corruption Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp1

CVE-2013-0083

2013-03-12T20:55:01.200-04:00

2018-10-12T18:03:42.987-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-071A MS MS13-024 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp1

CVE-2013-0084

2013-03-12T20:55:01.217-04:00

2018-10-12T18:03:43.173-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CERT TA13-071A MS MS13-024 Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp1

CVE-2013-0085

2013-03-12T20:55:01.230-04:00

2018-10-12T18:03:43.487-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-071A MS MS13-024 Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2010:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp1

CVE-2013-0086

2013-03-12T20:55:01.247-04:00

2018-10-12T18:03:43.800-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-071A MS MS13-025 Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0087

2013-03-12T20:55:01.263-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-071A MS MS13-021 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer OnResize Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0088

2013-03-12T20:55:01.277-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0089

2013-03-12T20:55:01.293-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0090

2013-03-12T20:55:01.310-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.skylined.nl/20161216001.html MISC http://packetstormsecurity.com/files/140186/Microsoft-Internet-Explorer-9-IEFRAME-CView-EnsureSize-Use-After-Free.html CERT TA13-071A MS MS13-021 EXPLOIT-DB 40935 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:8

CVE-2013-0091

2013-03-12T20:55:01.327-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CERT TA13-071A MS MS13-021 Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0092

2013-03-12T20:55:01.357-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0093

2013-03-12T20:55:01.370-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:internet_explorer:6 cpe:/a:microsoft:internet_explorer:7 cpe:/a:microsoft:internet_explorer:8 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10

CVE-2013-0094

2013-03-12T20:55:01.387-04:00

2019-02-26T09:04:00.993-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

cpe:/a:microsoft:office:2008::mac cpe:/a:microsoft:office:2011::mac

CVE-2013-0095

2013-03-12T20:55:01.403-04:00

2018-10-12T18:03:48.143-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT TA13-071A MS MS13-026 Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the installation of a WebKit browser on the victim's machine, aka "Unintended Content Loading Vulnerability."

cpe:/a:microsoft:windows_essentials:2011 cpe:/a:microsoft:windows_essentials:2012

CVE-2013-0096

2013-05-14T23:36:33.357-04:00

2018-10-12T18:03:48.457-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CERT TA13-134A MS MS13-045 Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."

CVE-2013-0097

2017-05-11T10:29:24.997-04:00

2017-05-11T10:29:25.013-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0098

2017-05-11T10:29:25.027-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0099

2017-05-11T10:29:25.060-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

CVE-2013-0100

2017-05-11T10:29:25.077-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:foxitsoftware:foxit_advanced_pdf_editor:3.0

CVE-2013-0107

2013-01-26T16:55:01.007-05:00

2013-01-30T00:00:00.000-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2013-01-28T10:13:00.000-05:00

CERT-VN VU#275219 Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing instructions that reconstruct a certain security cookie.

cpe:/a:honeywell:comfortpoint_open_manager_station:r100 cpe:/a:honeywell:enterprise_buildings_integrator:r310 cpe:/a:honeywell:enterprise_buildings_integrator:r400.2 cpe:/a:honeywell:enterprise_buildings_integrator:r410.1 cpe:/a:honeywell:enterprise_buildings_integrator:r410.2 cpe:/a:honeywell:symmetre:r310 cpe:/a:honeywell:symmetre:r400.2 cpe:/a:honeywell:symmetre:r410.1

CVE-2013-0108

2013-02-24T06:48:21.407-05:00

2013-02-25T00:00:00.000-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-02-25T13:40:00.000-05:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.

cpe:/a:nvidia:display_driver:307.00:-:~~~windows~~ cpe:/a:nvidia:display_driver:310.00:-:~~~windows~~

CVE-2013-0109

2013-04-08T12:55:01.977-04:00

2013-04-09T00:00:00.000-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-09T10:02:00.000-04:00

CERT-VN VU#957036 CONFIRM http://www.nvidia.com/object/product-security.html The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or cause a denial of service (memory overwrite) via a crafted application.

cpe:/a:nvidia:driver:307.00:-:~~~windows~~ cpe:/a:nvidia:driver:310.00:-:~~~windows~~

CVE-2013-0110

2013-04-08T12:55:02.010-04:00

2013-04-09T10:19:41.337-04:00

6.8

LOCAL

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-04-09T10:14:00.000-04:00

CERT-VN VU#957036 CONFIRM http://www.nvidia.com/object/product-security.html nvSCPAPISvr.exe in the NVIDIA Stereoscopic 3D Driver service, as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.

cpe:/a:nvidia:driver:307.00:-:~~~windows~~ cpe:/a:nvidia:driver:310.00:-:~~~windows~~

CVE-2013-0111

2013-04-08T12:55:02.073-04:00

2013-04-09T10:24:19.733-04:00

6.8

LOCAL

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-04-09T10:21:00.000-04:00

CERT-VN VU#957036 CONFIRM http://www.nvidia.com/object/product-security.html daemonu.exe (aka the NVIDIA Update Service Daemon), as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.

cpe:/a:nuance:pdf_reader:7.0 cpe:/a:nuance:pdf_reader_plus:7.1

CVE-2013-0113

2013-02-24T06:48:21.457-05:00

2013-02-26T00:00:00.000-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-02-25T12:54:00.000-05:00

CERT-VN VU#248449 Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.

cpe:/a:cs-cart:cs-cart:3.0 cpe:/a:cs-cart:cs-cart:3.0.2 cpe:/a:cs-cart:cs-cart:3.0.3 cpe:/a:cs-cart:cs-cart:3.0.4 cpe:/a:cs-cart:cs-cart:3.0.5

CVE-2013-0118

2013-02-24T06:48:21.487-05:00

2013-02-25T00:00:00.000-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-25T13:43:00.000-05:00

CERT-VN VU#583564 CONFIRM http://www.kb.cert.org/vuls/id/BLUU-949PQL CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

cpe:/h:dell:powerconnect_6248p:-

CVE-2013-0120

2013-02-24T06:48:21.533-05:00

2013-02-25T00:00:00.000-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-02-25T13:35:00.000-05:00

CERT-VN VU#160460 The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.

cpe:/a:avast:avast%21_mobile_security:2.0.4304::~~~android~~

CVE-2013-0122

2013-04-21T23:27:12.987-04:00

2015-01-08T08:36:50.877-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2015-01-07T15:15:38.670-05:00

CERT-VN VU#131263 The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity with zero arguments.

cpe:/a:askia:askiaweb:-

CVE-2013-0123

2013-03-21T17:55:00.887-04:00

2013-03-22T00:00:00.000-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-03-22T11:47:00.000-04:00

CERT-VN VU#406596 Multiple SQL injection vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to execute arbitrary SQL commands via (1) the nHistoryId parameter to WebProd/pages/pgHistory.asp or (2) the OrderBy parameter to WebProd/pages/pgadmin.asp.

cpe:/a:askia:askiaweb:-

CVE-2013-0124

2013-03-21T17:55:00.910-04:00

2013-03-22T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T11:51:00.000-04:00

CERT-VN VU#406596 Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the (1) Number or (2) UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll.

cpe:/a:c2enterprise:c2_webresource:-

CVE-2013-0125

2013-04-04T15:55:01.150-04:00

2013-04-05T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-05T08:39:00.000-04:00

CERT-VN VU#418923 Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.

cpe:/h:verizon:fios_actiontec_mi424wr-gen31_router:- cpe:/o:verizon:fios_actiontec_mi424wr-gen31_router_firmware:40.19.36

CVE-2013-0126

2013-03-21T16:55:01.910-04:00

2013-10-07T16:31:53.100-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-10-07T15:48:52.347-04:00

MISC http://infosec42.blogspot.com/2013/03/verizon-fios-router-csrf-cve-2013-0126.html EXPLOIT-DB 24860 CERT-VN VU#278204 Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.

cpe:/a:ibm:lotus_notes:8.0 cpe:/a:ibm:lotus_notes:8.0.0 cpe:/a:ibm:lotus_notes:8.0.1 cpe:/a:ibm:lotus_notes:8.0.2 cpe:/a:ibm:lotus_notes:8.0.2.0 cpe:/a:ibm:lotus_notes:8.0.2.1 cpe:/a:ibm:lotus_notes:8.0.2.2 cpe:/a:ibm:lotus_notes:8.0.2.3 cpe:/a:ibm:lotus_notes:8.0.2.4 cpe:/a:ibm:lotus_notes:8.0.2.5 cpe:/a:ibm:lotus_notes:8.0.2.6 cpe:/a:ibm:lotus_notes:8.5 cpe:/a:ibm:lotus_notes:8.5.0.0 cpe:/a:ibm:lotus_notes:8.5.0.1 cpe:/a:ibm:lotus_notes:8.5.1 cpe:/a:ibm:lotus_notes:8.5.1.0 cpe:/a:ibm:lotus_notes:8.5.1.1 cpe:/a:ibm:lotus_notes:8.5.1.2 cpe:/a:ibm:lotus_notes:8.5.1.3 cpe:/a:ibm:lotus_notes:8.5.1.4 cpe:/a:ibm:lotus_notes:8.5.1.5 cpe:/a:ibm:lotus_notes:8.5.2.0 cpe:/a:ibm:lotus_notes:8.5.2.1 cpe:/a:ibm:lotus_notes:8.5.2.2 cpe:/a:ibm:lotus_notes:8.5.2.3 cpe:/a:ibm:lotus_notes:8.5.3 cpe:/a:ibm:lotus_notes:8.5.3.1 cpe:/a:ibm:lotus_notes:8.5.3.2 cpe:/a:ibm:lotus_notes:8.5.3.3 cpe:/a:ibm:lotus_notes:9.0.0.0

CVE-2013-0127

2013-05-01T08:00:07.730-04:00

2017-08-28T21:32:59.323-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20130501 n.runs-SA-2013.005 - IBM Lotus Notes - arbitrary code execution CERT-VN VU#912420 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633819 XF ibm-notes-applet-tags(83775) IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and JMOY95BN49.

cpe:/a:tigertext:tigertext:3.1:-:~~~iphone_os~~

CVE-2013-0128

2013-04-04T15:55:01.170-04:00

2013-04-05T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-05T09:01:00.000-04:00

CERT-VN VU#704916 The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint.

cpe:/a:pd-admin:pd-admin:4.16

CVE-2013-0129

2013-04-19T07:44:10.950-04:00

2013-04-22T00:00:00.000-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-22T08:36:00.000-04:00

CERT-VN VU#311644 CONFIRM http://www.pdadmin-forum.de/thread.php?threadid=4051 Multiple cross-site scripting (XSS) vulnerabilities in pd-admin before 4.17 allow remote authenticated users to inject arbitrary web script or HTML via (1) the WebFTP Overview "Create new directory" field or (2) the body of an e-mail autoresponder message.

cpe:/a:coreftp:coreftp:2.2

CVE-2013-0130

2013-03-29T13:42:29.747-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov

2013-03-29T13:44:00.000-04:00

CONFIRM http://www.coreftp.com/forums/viewtopic.php?t=222102 CERT-VN VU#370868 Multiple buffer overflows in Core FTP before 2.2 build 1769 allow remote FTP servers to execute arbitrary code or cause a denial of service (application crash) via a long directory name in a (1) DELE, (2) LIST, or (3) VIEW command.

cpe:/a:nvidia:gpu_driver:195.22:-:~~esx~~~ cpe:/a:nvidia:gpu_driver:195.22:-:~~freebsd~~~ cpe:/a:nvidia:gpu_driver:195.22:-:~~linux_kernel~~~ cpe:/a:nvidia:gpu_driver:195.22:-:~~sunos~~~ cpe:/a:nvidia:gpu_driver:304.00:-:~~esx~~~ cpe:/a:nvidia:gpu_driver:304.00:-:~~freebsd~~~ cpe:/a:nvidia:gpu_driver:304.00:-:~~linux_kernel~~~ cpe:/a:nvidia:gpu_driver:304.00:-:~~sunos~~~ cpe:/a:nvidia:gpu_driver:310.00:-:~~esx~~~ cpe:/a:nvidia:gpu_driver:310.00:-:~~freebsd~~~ cpe:/a:nvidia:gpu_driver:310.00:-:~~linux_kernel~~~ cpe:/a:nvidia:gpu_driver:310.00:-:~~sunos~~~ cpe:/a:nvidia:gpu_driver:313.00:-:~~esx~~~ cpe:/a:nvidia:gpu_driver:313.00:-:~~freebsd~~~ cpe:/a:nvidia:gpu_driver:313.00:-:~~linux_kernel~~~ cpe:/a:nvidia:gpu_driver:313.00:-:~~sunos~~~

CVE-2013-0131

2013-04-08T12:55:02.127-04:00

2013-08-22T02:48:18.350-04:00

7.1

NETWORK

HIGH

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/3290 GENTOO GLSA-201304-01 CERT-VN VU#771620 CONFIRM http://www.nvidia.com/object/product-security.html Buffer overflow in the NVIDIA GPU driver before 304.88, 310.x before 310.44, and 313.x before 313.30 for the X Window System on UNIX, when NoScanout mode is enabled, allows remote authenticated users to execute arbitrary code via a large ARGB cursor.

cpe:/a:parallels:parallels_plesk_panel:11.0.9

CVE-2013-0132

2013-04-18T14:55:01.583-04:00

2013-04-19T00:00:00.000-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-04-19T08:05:00.000-04:00

CERT-VN VU#310500 The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables.

cpe:/a:parallels:parallels_plesk_panel:11.0.9

CVE-2013-0133

2013-04-18T14:55:03.803-04:00

2013-04-19T00:00:00.000-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-19T08:11:00.000-04:00

CERT-VN VU#310500 Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable.

cpe:/a:airdroid:airdroid:-

CVE-2013-0134

2013-04-08T23:34:53.260-04:00

2013-04-09T11:22:47.260-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-09T11:21:00.000-04:00

CERT-VN VU#557252 Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via a crafted text message that is transmitted by a managed phone.

cpe:/a:chatelao:php_address_book:8.2.5

CVE-2013-0135

2013-04-08T23:34:53.650-04:00

2017-08-28T21:32:59.387-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html MISC http://www.acadion.nl/labs/advisory/20130203-phpaddressbook.html CERT-VN VU#183692 XF phpaddressbook-checklogin-auth-bypass(99623) Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.

cpe:/a:mutiny:mutiny:5.0-1.00 cpe:/a:mutiny:mutiny:5.0-1.10 cpe:/a:mutiny:mutiny_virtual_appliance:- cpe:/h:mutiny:mutiny_appliance:-

CVE-2013-0136

2013-06-01T10:21:05.813-04:00

2013-06-03T00:00:00.000-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-06-03T10:36:00.000-04:00

CERT-VN VU#701572 MISC https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

cpe:/h:digital_alert_systems:dasdec_eas:2.0-0 cpe:/h:digital_alert_systems:dasdec_eas:2.0-1 cpe:/h:monroe_electronics:r189_one-net_eas:2.0-0 cpe:/h:monroe_electronics:r189_one-net_eas:2.0-1

CVE-2013-0137

2013-06-30T15:28:09.593-04:00

2013-07-01T00:00:00.000-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-07-01T14:27:00.000-04:00

CONFIRM http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf CERT-VN VU#662676 CONFIRM http://www.kb.cert.org/vuls/id/AAMN-98MU7H CONFIRM http://www.kb.cert.org/vuls/id/AAMN-98MUK2 CONFIRM http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session.

cpe:/a:bitberry_software:bitzipper:2013

CVE-2013-0138

2013-04-21T23:27:13.010-04:00

2013-04-22T00:00:00.000-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-04-22T10:32:00.000-04:00

CERT-VN VU#880916 CONFIRM http://www.kb.cert.org/vuls/id/BLUU-95GP23 BitZipper 2013 before Update 1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ZIP archive.

cpe:/h:arecont:vision_av1355dn_megadome_camera:-

CVE-2013-0139

2013-04-18T14:55:03.827-04:00

2013-04-19T00:00:00.000-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-19T08:19:00.000-04:00

CERT-VN VU#375180 The Arecont Vision AV1355DN MegaDome camera allows remote attackers to cause a denial of service (video-capture outage) via a packet to UDP port 69.

cpe:/a:mcafee:epolicy_orchestrator:2.0 cpe:/a:mcafee:epolicy_orchestrator:2.5 cpe:/a:mcafee:epolicy_orchestrator:2.5:sp1 cpe:/a:mcafee:epolicy_orchestrator:2.5.1 cpe:/a:mcafee:epolicy_orchestrator:3.0 cpe:/a:mcafee:epolicy_orchestrator:3.0:sp2a cpe:/a:mcafee:epolicy_orchestrator:3.5.0 cpe:/a:mcafee:epolicy_orchestrator:3.6.0 cpe:/a:mcafee:epolicy_orchestrator:3.6.1 cpe:/a:mcafee:epolicy_orchestrator:4.0 cpe:/a:mcafee:epolicy_orchestrator:4.5.0 cpe:/a:mcafee:epolicy_orchestrator:4.5.3 cpe:/a:mcafee:epolicy_orchestrator:4.5.4 cpe:/a:mcafee:epolicy_orchestrator:4.5.5 cpe:/a:mcafee:epolicy_orchestrator:4.5.6 cpe:/a:mcafee:epolicy_orchestrator:4.6.0 cpe:/a:mcafee:epolicy_orchestrator:4.6.1 cpe:/a:mcafee:epolicy_orchestrator:4.6.2 cpe:/a:mcafee:epolicy_orchestrator:4.6.3 cpe:/a:mcafee:epolicy_orchestrator:4.6.4 cpe:/a:mcafee:epolicy_orchestrator:4.6.5

CVE-2013-0140

2013-05-01T08:00:07.827-04:00

2017-11-15T21:29:00.457-05:00

7.9

ADJACENT_NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov FULLDISC 20140427 Re: Exploit: McAfee ePolicy 0wner (ePowner ) Ã¢â?¬â?? Release CERT-VN VU#209131 BID 59500 CERT TA13-193A CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10042 SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.

CVE-2013-0141

2013-05-01T08:00:07.850-04:00

2017-11-15T21:29:00.537-05:00

4.3

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FULLDISC 20140427 Re: Exploit: McAfee ePolicy 0wner (ePowner ) Ã¢â?¬â?? Release CERT-VN VU#209131 CERT TA13-193A CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10042 Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.

cpe:/a:qnap:surveillance_station_pro:- cpe:/h:qnap:nas:- cpe:/h:qnap:viostor_network_video_recorder:- cpe:/o:qnap:viostor_network_video_recorder:4.0.3

CVE-2013-0142

2013-06-07T16:55:01.317-04:00

2013-06-10T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-06-10T09:03:00.000-04:00

CERT-VN VU#927644 QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors.

cpe:/a:qnap:surveillance_station_pro:- cpe:/h:qnap:nas:- cpe:/h:qnap:viostor_network_video_recorder:- cpe:/o:qnap:viostor_network_video_recorder:4.0.3

CVE-2013-0143

2013-06-07T16:55:01.347-04:00

2013-06-10T00:00:00.000-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2013-06-10T09:13:00.000-04:00

CERT-VN VU#927644 cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.

cpe:/h:qnap:viostor_network_video_recorder:- cpe:/o:qnap:viostor_network_video_recorder:4.0.3

CVE-2013-0144

2013-06-07T16:55:01.370-04:00

2013-06-10T09:19:57.060-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-06-10T09:16:00.000-04:00

CERT-VN VU#927644 Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.

cpe:/a:vercot:serva32:2.1.0

CVE-2013-0145

2013-05-20T10:44:34.263-04:00

2013-05-23T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-05-20T11:22:00.000-04:00

CERT-VN VU#127108 Buffer overflow in the TFTPD service in Serva32 2.1.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in a read request.

cpe:/a:faircom:c-treeace:-

CVE-2013-0148

2013-06-16T13:55:00.987-04:00

2017-01-19T21:59:02.167-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

NONE

http://nvd.nist.gov CERT-VN VU#900031 The Data Camouflage (aka FairCom Standard Encryption) algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certain default configuration.

cpe:/h:cisco:asa_5500:7.0 cpe:/h:cisco:asa_5500:7.1 cpe:/h:cisco:asa_5500:7.2 cpe:/h:cisco:asa_5500:8.0 cpe:/h:cisco:asa_5500:8.1 cpe:/h:cisco:asa_5500:8.2 cpe:/h:cisco:asa_5500:9.0 cpe:/h:cisco:asa_5500:9.1 cpe:/h:cisco:fwsm cpe:/o:cisco:ios:12.0 cpe:/o:cisco:ios:12.0%281%29 cpe:/o:cisco:ios:12.0%281%29s cpe:/o:cisco:ios:12.0%281%29st cpe:/o:cisco:ios:12.0%281%29w cpe:/o:cisco:ios:12.0%281%29xa3 cpe:/o:cisco:ios:12.0%281%29xb cpe:/o:cisco:ios:12.0%281%29xe cpe:/o:cisco:ios:12.0%282%29 cpe:/o:cisco:ios:12.0%282%29xc cpe:/o:cisco:ios:12.0%282%29xd cpe:/o:cisco:ios:12.0%282%29xe cpe:/o:cisco:ios:12.0%282%29xf cpe:/o:cisco:ios:12.0%282%29xg cpe:/o:cisco:ios:12.0%282a%29 cpe:/o:cisco:ios:12.0%282b%29 cpe:/o:cisco:ios:12.0%283%29 cpe:/o:cisco:ios:12.0%283%29t2 cpe:/o:cisco:ios:12.0%283%29xe cpe:/o:cisco:ios:12.0%283.2%29 cpe:/o:cisco:ios:12.0%283.3%29s cpe:/o:cisco:ios:12.0%283.4%29t cpe:/o:cisco:ios:12.0%283.6%29w5%289.0.5%29 cpe:/o:cisco:ios:12.0%283d%29 cpe:/o:cisco:ios:12.0%284%29 cpe:/o:cisco:ios:12.0%284%29s cpe:/o:cisco:ios:12.0%284%29t cpe:/o:cisco:ios:12.0%284%29xe cpe:/o:cisco:ios:12.0%284%29xe1 cpe:/o:cisco:ios:12.0%284%29xm cpe:/o:cisco:ios:12.0%284%29xm1 cpe:/o:cisco:ios:12.0%285%29 cpe:/o:cisco:ios:12.0%285%29s cpe:/o:cisco:ios:12.0%285%29t cpe:/o:cisco:ios:12.0%285%29t1 cpe:/o:cisco:ios:12.0%285%29t2 cpe:/o:cisco:ios:12.0%285%29wc cpe:/o:cisco:ios:12.0%285%29wc2 cpe:/o:cisco:ios:12.0%285%29wc2b cpe:/o:cisco:ios:12.0%285%29wc3 cpe:/o:cisco:ios:12.0%285%29wc3b cpe:/o:cisco:ios:12.0%285%29wc5a cpe:/o:cisco:ios:12.0%2805%29wc8 cpe:/o:cisco:ios:12.0%285%29wc9 cpe:/o:cisco:ios:12.0%285%29wc9a cpe:/o:cisco:ios:12.0%285%29wc11 cpe:/o:cisco:ios:12.0%285%29wc13 cpe:/o:cisco:ios:12.0%285%29wx cpe:/o:cisco:ios:12.0%285%29xe cpe:/o:cisco:ios:12.0%285%29xk cpe:/o:cisco:ios:12.0%285%29xk2 cpe:/o:cisco:ios:12.0%285%29xn cpe:/o:cisco:ios:12.0%285%29xn1 cpe:/o:cisco:ios:12.0%285%29xs cpe:/o:cisco:ios:12.0%285%29xu cpe:/o:cisco:ios:12.0%285%29yb4 cpe:/o:cisco:ios:12.0%285.1%29xp cpe:/o:cisco:ios:12.0%285.2%29xu cpe:/o:cisco:ios:12.0%285.3%29wc1 cpe:/o:cisco:ios:12.0%285.4%29wc1 cpe:/o:cisco:ios:12.0%285a%29e cpe:/o:cisco:ios:12.0%286%29 cpe:/o:cisco:ios:12.0%286b%29 cpe:/o:cisco:ios:12.0%287%29db2 cpe:/o:cisco:ios:12.0%287%29dc1 cpe:/o:cisco:ios:12.0%287%29s1 cpe:/o:cisco:ios:12.0%287%29sc cpe:/o:cisco:ios:12.0%287%29t cpe:/o:cisco:ios:12.0%287%29t2 cpe:/o:cisco:ios:12.0%287%29t3 cpe:/o:cisco:ios:12.0%287%29wx5%2815a%29 cpe:/o:cisco:ios:12.0%287%29xe cpe:/o:cisco:ios:12.0%287%29xe2 cpe:/o:cisco:ios:12.0%287%29xf cpe:/o:cisco:ios:12.0%287%29xf1 cpe:/o:cisco:ios:12.0%287%29xk cpe:/o:cisco:ios:12.0%287%29xk2 cpe:/o:cisco:ios:12.0%287%29xk3 cpe:/o:cisco:ios:12.0%287%29xv cpe:/o:cisco:ios:12.0%287.4%29s cpe:/o:cisco:ios:12.0%287a%29 cpe:/o:cisco:ios:12.0%288%29 cpe:/o:cisco:ios:12.0%288%29s1 cpe:/o:cisco:ios:12.0%288.0.2%29s cpe:/o:cisco:ios:12.0%288.3%29sc cpe:/o:cisco:ios:12.0%288a%29 cpe:/o:cisco:ios:12.0%289%29 cpe:/o:cisco:ios:12.0%289%29s cpe:/o:cisco:ios:12.0%289%29s8 cpe:/o:cisco:ios:12.0%289a%29 cpe:/o:cisco:ios:12.0%2810%29 cpe:/o:cisco:ios:12.0%2810%29s3b cpe:/o:cisco:ios:12.0%2810%29s7 cpe:/o:cisco:ios:12.0%2810%29s8 cpe:/o:cisco:ios:12.0%2810%29w5 cpe:/o:cisco:ios:12.0%2810%29w5%2818f%29 cpe:/o:cisco:ios:12.0%2810%29w5%2818g%29 cpe:/o:cisco:ios:12.0%2810a%29 cpe:/o:cisco:ios:12.0%2811%29s6 cpe:/o:cisco:ios:12.0%2811%29st4 cpe:/o:cisco:ios:12.0%2811a%29 cpe:/o:cisco:ios:12.0%2812%29 cpe:/o:cisco:ios:12.0%2812%29s3 cpe:/o:cisco:ios:12.0%2812%29s4 cpe:/o:cisco:ios:12.0%2812a%29 cpe:/o:cisco:ios:12.0%2813%29s6 cpe:/o:cisco:ios:12.0%2813%29s8 cpe:/o:cisco:ios:12.0%2813%29w5%2819c%29 cpe:/o:cisco:ios:12.0%2813%29wt6%281%29 cpe:/o:cisco:ios:12.0%2813a%29 cpe:/o:cisco:ios:12.0%2814%29 cpe:/o:cisco:ios:12.0%2814%29s7 cpe:/o:cisco:ios:12.0%2814%29s8 cpe:/o:cisco:ios:12.0%2814%29st cpe:/o:cisco:ios:12.0%2814%29st3 cpe:/o:cisco:ios:12.0%2814%29w5%2820%29 cpe:/o:cisco:ios:12.0%2814a%29 cpe:/o:cisco:ios:12.0%2815%29s cpe:/o:cisco:ios:12.0%2815%29s3 cpe:/o:cisco:ios:12.0%2815%29s6 cpe:/o:cisco:ios:12.0%2815%29s7 cpe:/o:cisco:ios:12.0%2815%29sc cpe:/o:cisco:ios:12.0%2815%29sl cpe:/o:cisco:ios:12.0%2815a%29 cpe:/o:cisco:ios:12.0%2816%29s cpe:/o:cisco:ios:12.0%2816%29s8 cpe:/o:cisco:ios:12.0%2816%29s8a cpe:/o:cisco:ios:12.0%2816%29s10 cpe:/o:cisco:ios:12.0%2816%29sc cpe:/o:cisco:ios:12.0%2816%29sc3 cpe:/o:cisco:ios:12.0%2816%29st cpe:/o:cisco:ios:12.0%2816%29st1 cpe:/o:cisco:ios:12.0%2816%29w5%2821%29 cpe:/o:cisco:ios:12.0%2816.06%29s cpe:/o:cisco:ios:12.0%2816a%29 cpe:/o:cisco:ios:12.0%2817%29 cpe:/o:cisco:ios:12.0%2817%29s cpe:/o:cisco:ios:12.0%2817%29s4 cpe:/o:cisco:ios:12.0%2817%29s7 cpe:/o:cisco:ios:12.0%2817%29sl cpe:/o:cisco:ios:12.0%2817%29sl2 cpe:/o:cisco:ios:12.0%2817%29sl6 cpe:/o:cisco:ios:12.0%2817%29sl9 cpe:/o:cisco:ios:12.0%2817%29st1 cpe:/o:cisco:ios:12.0%2817%29st5 cpe:/o:cisco:ios:12.0%2817%29st8 cpe:/o:cisco:ios:12.0%2817a%29 cpe:/o:cisco:ios:12.0%2818%29s cpe:/o:cisco:ios:12.0%2818%29s5 cpe:/o:cisco:ios:12.0%2818%29s5a cpe:/o:cisco:ios:12.0%2818%29s7 cpe:/o:cisco:ios:12.0%2818%29sl cpe:/o:cisco:ios:12.0%2818%29st1 cpe:/o:cisco:ios:12.0%2818%29w5%2822b%29 cpe:/o:cisco:ios:12.0%2818b%29 cpe:/o:cisco:ios:12.0%2819%29 cpe:/o:cisco:ios:12.0%2819%29s cpe:/o:cisco:ios:12.0%2819%29s2 cpe:/o:cisco:ios:12.0%2819%29s2a cpe:/o:cisco:ios:12.0%2819%29s4 cpe:/o:cisco:ios:12.0%2819%29sl cpe:/o:cisco:ios:12.0%2819%29sl4 cpe:/o:cisco:ios:12.0%2819%29sp cpe:/o:cisco:ios:12.0%2819%29st cpe:/o:cisco:ios:12.0%2819%29st2 cpe:/o:cisco:ios:12.0%2819%29st6 cpe:/o:cisco:ios:12.0%2819a%29 cpe:/o:cisco:ios:12.0%2820%29sl cpe:/o:cisco:ios:12.0%2820%29sp cpe:/o:cisco:ios:12.0%2820%29sp1 cpe:/o:cisco:ios:12.0%2820%29st2 cpe:/o:cisco:ios:12.0%2820%29st6 cpe:/o:cisco:ios:12.0%2820%29st7 cpe:/o:cisco:ios:12.0%2820%29sx cpe:/o:cisco:ios:12.0%2820%29w5%2822b%29 cpe:/o:cisco:ios:12.0%2820.4%29sp cpe:/o:cisco:ios:12.0%2820a%29 cpe:/o:cisco:ios:12.0%2821%29s cpe:/o:cisco:ios:12.0%2821%29s1 cpe:/o:cisco:ios:12.0%2821%29s3 cpe:/o:cisco:ios:12.0%2821%29s4a cpe:/o:cisco:ios:12.0%2821%29s5a cpe:/o:cisco:ios:12.0%2821%29s6 cpe:/o:cisco:ios:12.0%2821%29s7 cpe:/o:cisco:ios:12.0%2821%29sl cpe:/o:cisco:ios:12.0%2821%29st cpe:/o:cisco:ios:12.0%2821%29st6 cpe:/o:cisco:ios:12.0%2821%29st7 cpe:/o:cisco:ios:12.0%2821%29sx cpe:/o:cisco:ios:12.0%2821a%29 cpe:/o:cisco:ios:12.0%2822%29s cpe:/o:cisco:ios:12.0%2822%29s4 cpe:/o:cisco:ios:12.0%2822%29s5 cpe:/o:cisco:ios:12.0%2822%29sy cpe:/o:cisco:ios:12.0%2823%29s2 cpe:/o:cisco:ios:12.0%2823%29s3 cpe:/o:cisco:ios:12.0%2823%29s4 cpe:/o:cisco:ios:12.0%2823%29s5 cpe:/o:cisco:ios:12.0%2823%29s6 cpe:/o:cisco:ios:12.0%2823%29sx cpe:/o:cisco:ios:12.0%2823%29sz cpe:/o:cisco:ios:12.0%2824%29s1 cpe:/o:cisco:ios:12.0%2824%29s2 cpe:/o:cisco:ios:12.0%2824%29s4 cpe:/o:cisco:ios:12.0%2824%29s5 cpe:/o:cisco:ios:12.0%2824%29s6 cpe:/o:cisco:ios:12.0%2824.2%29s cpe:/o:cisco:ios:12.0%2825%29s1 cpe:/o:cisco:ios:12.0%2825%29w5%2827%29 cpe:/o:cisco:ios:12.0%2825%29w5%2827c%29 cpe:/o:cisco:ios:12.0%2825%29w5-27d cpe:/o:cisco:ios:12.0%2825.4%29s1 cpe:/o:cisco:ios:12.0%2826%29 cpe:/o:cisco:ios:12.0%2826%29s cpe:/o:cisco:ios:12.0%2826%29s1 cpe:/o:cisco:ios:12.0%2826%29s2 cpe:/o:cisco:ios:12.0%2826%29s6 cpe:/o:cisco:ios:12.0%2826%29w5%2828%29 cpe:/o:cisco:ios:12.0%2826%29w5%2828a%29 cpe:/o:cisco:ios:12.0%2827%29 cpe:/o:cisco:ios:12.0%2827%29s cpe:/o:cisco:ios:12.0%2827%29s1 cpe:/o:cisco:ios:12.0%2827%29sv cpe:/o:cisco:ios:12.0%2827%29sv1 cpe:/o:cisco:ios:12.0%2827%29sv2 cpe:/o:cisco:ios:12.0%2828%29 cpe:/o:cisco:ios:12.0%2828%29s3 cpe:/o:cisco:ios:12.0%2828%29s5 cpe:/o:cisco:ios:12.0%2828%29w5%2831a%29 cpe:/o:cisco:ios:12.0%2828%29w5-30b cpe:/o:cisco:ios:12.0%2828%29w5-32a cpe:/o:cisco:ios:12.0%2828c%29 cpe:/o:cisco:ios:12.0%2828d%29 cpe:/o:cisco:ios:12.0%2830%29s1 cpe:/o:cisco:ios:12.0%2830%29s2 cpe:/o:cisco:ios:12.0%2830%29s4 cpe:/o:cisco:ios:12.0%2831%29s cpe:/o:cisco:ios:12.0%2831%29s1 cpe:/o:cisco:ios:12.0%2832%29s12 cpe:/o:cisco:ios:12.0%2832%29s13 cpe:/o:cisco:ios:12.0%2832%29sy8 cpe:/o:cisco:ios:12.0%2832%29sy9 cpe:/o:cisco:ios:12.0%2833%29s3 cpe:/o:cisco:ios:12.0%2833%29s4 cpe:/o:cisco:ios:12.0da cpe:/o:cisco:ios:12.0db cpe:/o:cisco:ios:12.0dc cpe:/o:cisco:ios:12.0ev cpe:/o:cisco:ios:12.0s cpe:/o:cisco:ios:12.0sc cpe:/o:cisco:ios:12.0sl cpe:/o:cisco:ios:12.0sp cpe:/o:cisco:ios:12.0st cpe:/o:cisco:ios:12.0sv cpe:/o:cisco:ios:12.0sx cpe:/o:cisco:ios:12.0sy cpe:/o:cisco:ios:12.0sz cpe:/o:cisco:ios:12.0t cpe:/o:cisco:ios:12.0w cpe:/o:cisco:ios:12.0w5 cpe:/o:cisco:ios:12.0wc cpe:/o:cisco:ios:12.0wt cpe:/o:cisco:ios:12.0wx cpe:/o:cisco:ios:12.0xa cpe:/o:cisco:ios:12.0xb cpe:/o:cisco:ios:12.0xc cpe:/o:cisco:ios:12.0xd cpe:/o:cisco:ios:12.0xe cpe:/o:cisco:ios:12.0xf cpe:/o:cisco:ios:12.0xg cpe:/o:cisco:ios:12.0xh cpe:/o:cisco:ios:12.0xi cpe:/o:cisco:ios:12.0xj cpe:/o:cisco:ios:12.0xk cpe:/o:cisco:ios:12.0xl cpe:/o:cisco:ios:12.0xm cpe:/o:cisco:ios:12.0xn cpe:/o:cisco:ios:12.0xp cpe:/o:cisco:ios:12.0xq cpe:/o:cisco:ios:12.0xr cpe:/o:cisco:ios:12.0xs cpe:/o:cisco:ios:12.0xt cpe:/o:cisco:ios:12.0xu cpe:/o:cisco:ios:12.0xv cpe:/o:cisco:ios:12.0xw cpe:/o:cisco:ios:12.1 cpe:/o:cisco:ios:12.1%281%29 cpe:/o:cisco:ios:12.1%281%29db cpe:/o:cisco:ios:12.1%281%29db2 cpe:/o:cisco:ios:12.1%281%29dc cpe:/o:cisco:ios:12.1%281%29dc2 cpe:/o:cisco:ios:12.1%281%29e5 cpe:/o:cisco:ios:12.1%281%29ex cpe:/o:cisco:ios:12.1%281%29t cpe:/o:cisco:ios:12.1%281.3%29t cpe:/o:cisco:ios:12.1%281a%29t1 cpe:/o:cisco:ios:12.1%281c%29 cpe:/o:cisco:ios:12.1%282%29e1 cpe:/o:cisco:ios:12.1%282%29t cpe:/o:cisco:ios:12.1%282%29xf cpe:/o:cisco:ios:12.1%282%29xf4 cpe:/o:cisco:ios:12.1%282%29xf5 cpe:/o:cisco:ios:12.1%286%29ea2c cpe:/o:cisco:ios:12.1%286%29ey cpe:/o:cisco:ios:12.1%286%29ez1 cpe:/o:cisco:ios:12.1%286%29ez2 cpe:/o:cisco:ios:12.1%286.5%29 cpe:/o:cisco:ios:12.1%286.5%29ec3 cpe:/o:cisco:ios:12.1%286a%29 cpe:/o:cisco:ios:12.1%287%29 cpe:/o:cisco:ios:12.1%287%29cx cpe:/o:cisco:ios:12.1%287%29da2 cpe:/o:cisco:ios:12.1%287%29da3 cpe:/o:cisco:ios:12.1%287%29ec cpe:/o:cisco:ios:12.1%287a%29e6 cpe:/o:cisco:ios:12.1%287a%29ey cpe:/o:cisco:ios:12.1%287a%29ey3 cpe:/o:cisco:ios:12.1%287b%29 cpe:/o:cisco:ios:12.1%288%29 cpe:/o:cisco:ios:12.1%288%29aa1 cpe:/o:cisco:ios:12.1%288%29e cpe:/o:cisco:ios:12.1%288%29ea cpe:/o:cisco:ios:12.1%288%29ea1b cpe:/o:cisco:ios:12.1%288%29ea2b cpe:/o:cisco:ios:12.1%288a%29e cpe:/o:cisco:ios:12.1%288a%29ew cpe:/o:cisco:ios:12.1%288a%29ew1 cpe:/o:cisco:ios:12.1%288a%29ex cpe:/o:cisco:ios:12.1%288b%29e8 cpe:/o:cisco:ios:12.1%288b%29e9 cpe:/o:cisco:ios:12.1%288b%29e14 cpe:/o:cisco:ios:12.1%288b%29e15 cpe:/o:cisco:ios:12.1%288b%29e16 cpe:/o:cisco:ios:12.1%288b%29e18 cpe:/o:cisco:ios:12.1%288b%29e20 cpe:/o:cisco:ios:12.1%288b%29ex4 cpe:/o:cisco:ios:12.1%288c%29 cpe:/o:cisco:ios:12.1%289%29 cpe:/o:cisco:ios:12.1%289%29aa cpe:/o:cisco:ios:12.1%289%29e cpe:/o:cisco:ios:12.1%289%29e3 cpe:/o:cisco:ios:12.1%289%29ea cpe:/o:cisco:ios:12.1%289%29ex cpe:/o:cisco:ios:12.1%289%29ex3 cpe:/o:cisco:ios:12.1%289a%29 cpe:/o:cisco:ios:12.1%2810%29 cpe:/o:cisco:ios:12.1%2810%29aa cpe:/o:cisco:ios:12.1%2810%29e cpe:/o:cisco:ios:12.1%2810%29e4 cpe:/o:cisco:ios:12.1%2810%29ec cpe:/o:cisco:ios:12.1%2810%29ec1 cpe:/o:cisco:ios:12.1%2810%29ex cpe:/o:cisco:ios:12.1%2810%29ey cpe:/o:cisco:ios:12.1%2810.5%29ec cpe:/o:cisco:ios:12.1%2810a%29 cpe:/o:cisco:ios:12.1%2811%29 cpe:/o:cisco:ios:12.1%2811%29e cpe:/o:cisco:ios:12.1%2811%29ea1 cpe:/o:cisco:ios:12.1%2811%29ec cpe:/o:cisco:ios:12.1%2811.5%29e cpe:/o:cisco:ios:12.1%2811a%29 cpe:/o:cisco:ios:12.1%2811b%29 cpe:/o:cisco:ios:12.1%2811b%29e cpe:/o:cisco:ios:12.1%2811b%29e12 cpe:/o:cisco:ios:12.1%2811b%29e14 cpe:/o:cisco:ios:12.1%2812%29 cpe:/o:cisco:ios:12.1%2812%29e cpe:/o:cisco:ios:12.1%2812a%29 cpe:/o:cisco:ios:12.1%2812b%29 cpe:/o:cisco:ios:12.1%2812c%29 cpe:/o:cisco:ios:12.1%2812c%29e7 cpe:/o:cisco:ios:12.1%2812c%29ec cpe:/o:cisco:ios:12.1%2812c%29ev01 cpe:/o:cisco:ios:12.1%2812c%29ew4 cpe:/o:cisco:ios:12.1%2813%29 cpe:/o:cisco:ios:12.1%2813%29ay cpe:/o:cisco:ios:12.1%2813%29e1 cpe:/o:cisco:ios:12.1%2813%29e3 cpe:/o:cisco:ios:12.1%2813%29e7 cpe:/o:cisco:ios:12.1%2813%29e9 cpe:/o:cisco:ios:12.1%2813%29e12 cpe:/o:cisco:ios:12.1%2813%29e13 cpe:/o:cisco:ios:12.1%2813%29e17 cpe:/o:cisco:ios:12.1%2813%29ea1 cpe:/o:cisco:ios:12.1%2813%29ea1c cpe:/o:cisco:ios:12.1%2813%29ew cpe:/o:cisco:ios:12.1%2813%29ew4 cpe:/o:cisco:ios:12.1%2813%29ex2 cpe:/o:cisco:ios:12.1%2813.4%29e cpe:/o:cisco:ios:12.1%2814%29 cpe:/o:cisco:ios:12.1%2814%29e1 cpe:/o:cisco:ios:12.1%2814%29e4 cpe:/o:cisco:ios:12.1%2814%29e9 cpe:/o:cisco:ios:12.1%2814%29e10 cpe:/o:cisco:ios:12.1%2814%29ea1 cpe:/o:cisco:ios:12.1%2814%29eb cpe:/o:cisco:ios:12.1%2814.5%29 cpe:/o:cisco:ios:12.1%2815%29bc1 cpe:/o:cisco:ios:12.1%2816%29 cpe:/o:cisco:ios:12.1%2818%29 cpe:/o:cisco:ios:12.1%2818.4%29 cpe:/o:cisco:ios:12.1%2819%29 cpe:/o:cisco:ios:12.1%2819%29e cpe:/o:cisco:ios:12.1%2819%29e1 cpe:/o:cisco:ios:12.1%2819%29e6 cpe:/o:cisco:ios:12.1%2819%29ec cpe:/o:cisco:ios:12.1%2819%29ew cpe:/o:cisco:ios:12.1%2819%29ew3 cpe:/o:cisco:ios:12.1%2819%29fc1 cpe:/o:cisco:ios:12.1%2819.3%29e cpe:/o:cisco:ios:12.1%2820%29 cpe:/o:cisco:ios:12.1%2820%29e cpe:/o:cisco:ios:12.1%2820%29e1 cpe:/o:cisco:ios:12.1%2820%29e2 cpe:/o:cisco:ios:12.1%2820%29e3 cpe:/o:cisco:ios:12.1%2820%29e5 cpe:/o:cisco:ios:12.1%2820%29ea1 cpe:/o:cisco:ios:12.1%2820%29ea1a cpe:/o:cisco:ios:12.1%2820%29ec cpe:/o:cisco:ios:12.1%2820%29ec1 cpe:/o:cisco:ios:12.1%2820%29ec2 cpe:/o:cisco:ios:12.1%2820%29eo cpe:/o:cisco:ios:12.1%2820%29eo1 cpe:/o:cisco:ios:12.1%2820%29eo3 cpe:/o:cisco:ios:12.1%2820%29ew cpe:/o:cisco:ios:12.1%2820%29ew1 cpe:/o:cisco:ios:12.1%2820%29ew2 cpe:/o:cisco:ios:12.1%2820%29ew4 cpe:/o:cisco:ios:12.1aa cpe:/o:cisco:ios:12.1ax cpe:/o:cisco:ios:12.1ay cpe:/o:cisco:ios:12.1az cpe:/o:cisco:ios:12.1cx cpe:/o:cisco:ios:12.1da cpe:/o:cisco:ios:12.1db cpe:/o:cisco:ios:12.1dc cpe:/o:cisco:ios:12.1e cpe:/o:cisco:ios:12.1ea cpe:/o:cisco:ios:12.1eb cpe:/o:cisco:ios:12.1ec cpe:/o:cisco:ios:12.1eo cpe:/o:cisco:ios:12.1eu cpe:/o:cisco:ios:12.1ev cpe:/o:cisco:ios:12.1ew cpe:/o:cisco:ios:12.1ex cpe:/o:cisco:ios:12.1ey cpe:/o:cisco:ios:12.1ez cpe:/o:cisco:ios:12.1ga cpe:/o:cisco:ios:12.1gb cpe:/o:cisco:ios:12.1m cpe:/o:cisco:ios:12.1s cpe:/o:cisco:ios:12.1sec cpe:/o:cisco:ios:12.1t cpe:/o:cisco:ios:12.1x%28l%29 cpe:/o:cisco:ios:12.1xa cpe:/o:cisco:ios:12.1xb cpe:/o:cisco:ios:12.1xc cpe:/o:cisco:ios:12.1xd cpe:/o:cisco:ios:12.1xe cpe:/o:cisco:ios:12.1xf cpe:/o:cisco:ios:12.1xg cpe:/o:cisco:ios:12.1xh cpe:/o:cisco:ios:12.1xi cpe:/o:cisco:ios:12.1xj cpe:/o:cisco:ios:12.1xk cpe:/o:cisco:ios:12.1xl cpe:/o:cisco:ios:12.1xm cpe:/o:cisco:ios:12.1xp cpe:/o:cisco:ios:12.1xq cpe:/o:cisco:ios:12.1xr cpe:/o:cisco:ios:12.1xs cpe:/o:cisco:ios:12.1xt cpe:/o:cisco:ios:12.1xu cpe:/o:cisco:ios:12.1xv cpe:/o:cisco:ios:12.1xw cpe:/o:cisco:ios:12.1xx cpe:/o:cisco:ios:12.1xy cpe:/o:cisco:ios:12.1xz cpe:/o:cisco:ios:12.1ya cpe:/o:cisco:ios:12.1yb cpe:/o:cisco:ios:12.1yc cpe:/o:cisco:ios:12.1yd cpe:/o:cisco:ios:12.1ye cpe:/o:cisco:ios:12.1yf cpe:/o:cisco:ios:12.1yh cpe:/o:cisco:ios:12.1yi cpe:/o:cisco:ios:12.1yj cpe:/o:cisco:ios_xe:2.1.0 cpe:/o:cisco:ios_xe:2.1.1 cpe:/o:cisco:ios_xe:2.1.2 cpe:/o:cisco:ios_xe:2.2.1 cpe:/o:cisco:ios_xe:2.2.2 cpe:/o:cisco:ios_xe:2.2.3 cpe:/o:cisco:ios_xe:2.3.0 cpe:/o:cisco:ios_xe:2.3.1 cpe:/o:cisco:ios_xe:2.3.1t cpe:/o:cisco:ios_xe:2.3.2 cpe:/o:cisco:ios_xe:2.4.0 cpe:/o:cisco:ios_xe:2.4.1 cpe:/o:cisco:ios_xe:2.4.2 cpe:/o:cisco:ios_xe:2.4.3 cpe:/o:cisco:ios_xe:2.4.4 cpe:/o:cisco:ios_xe:2.5.0 cpe:/o:cisco:ios_xe:2.5.1 cpe:/o:cisco:ios_xe:2.5.2 cpe:/o:cisco:ios_xe:2.6.0 cpe:/o:cisco:ios_xe:2.6.1 cpe:/o:cisco:ios_xe:2.6.2 cpe:/o:cisco:ios_xe:3.1.0s cpe:/o:cisco:ios_xe:3.1.0sg cpe:/o:cisco:ios_xe:3.1.1s cpe:/o:cisco:ios_xe:3.1.1sg cpe:/o:cisco:ios_xe:3.1.2s cpe:/o:cisco:ios_xe:3.1.3s cpe:/o:cisco:ios_xe:3.1.4s cpe:/o:cisco:ios_xe:3.2.00.xo.15.0%282%29xo cpe:/o:cisco:ios_xe:3.2.0s cpe:/o:cisco:ios_xe:3.2.0sg cpe:/o:cisco:ios_xe:3.2.0xo cpe:/o:cisco:ios_xe:3.2.1s cpe:/o:cisco:ios_xe:3.2.1sg cpe:/o:cisco:ios_xe:3.2.2s cpe:/o:cisco:ios_xe:3.2.2sg cpe:/o:cisco:ios_xe:3.2.3sg cpe:/o:cisco:ios_xe:3.2.4sg cpe:/o:cisco:ios_xe:3.3.0s cpe:/o:cisco:ios_xe:3.3.0sg cpe:/o:cisco:ios_xe:3.3.1s cpe:/o:cisco:ios_xe:3.3.1sg cpe:/o:cisco:ios_xe:3.3.2s cpe:/o:cisco:ios_xe:3.3.3s cpe:/o:cisco:ios_xe:3.4.0as cpe:/o:cisco:ios_xe:3.4.0s cpe:/o:cisco:ios_xe:3.4.1s cpe:/o:cisco:ios_xe:3.4.2s cpe:/o:cisco:ios_xe:3.4.3s cpe:/o:cisco:ios_xe:3.4.4s cpe:/o:cisco:ios_xe:3.4.5s cpe:/o:cisco:ios_xe:3.4.xs cpe:/o:cisco:ios_xe:3.5.0s cpe:/o:cisco:ios_xe:3.5.1s cpe:/o:cisco:ios_xe:3.5.2s cpe:/o:cisco:ios_xe:3.5.xs cpe:/o:cisco:ios_xe:3.6.0s cpe:/o:cisco:ios_xe:3.6.1s cpe:/o:cisco:ios_xe:3.6.2s cpe:/o:cisco:ios_xe:3.7.0s cpe:/o:cisco:ios_xe:3.7.1s cpe:/o:cisco:ios_xe:3.9.0s cpe:/o:cisco:nx-os:- cpe:/o:cisco:pix_firewall_software:7.0 cpe:/o:cisco:pix_firewall_software:7.1 cpe:/o:cisco:pix_firewall_software:7.2 cpe:/o:cisco:pix_firewall_software:8.0%282%29 cpe:/o:cisco:pix_firewall_software:9.0 cpe:/o:cisco:pix_firewall_software:9.1 cpe:/o:cisco:staros:14.0

CVE-2013-0149

2013-08-05T09:22:47.847-04:00

2013-08-13T13:18:34.893-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CISCO 20130801 OSPF LSA Manipulation Vulnerability in Multiple Cisco Products CERT-VN VU#229804 The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.

cpe:/a:f5:big-ip_access_policy_manager:10.1.0 cpe:/a:f5:big-ip_access_policy_manager:10.2.4 cpe:/a:f5:big-ip_access_policy_manager:11.0.0 cpe:/a:f5:big-ip_access_policy_manager:11.3.0 cpe:/h:f5:big-ip_access_policy_manager:10.1.0::~~~~~standalone cpe:/h:f5:big-ip_access_policy_manager:10.2.4::~~~~~standalone cpe:/h:f5:big-ip_access_policy_manager:11.0.0::~~~~~standalone cpe:/h:f5:big-ip_access_policy_manager:11.3.0::~~~~~standalone cpe:/h:f5:firepass:6.0 cpe:/h:f5:firepass:6.1.0 cpe:/h:f5:firepass:7.0.0

CVE-2013-0150

2013-08-09T16:56:06.917-04:00

2013-08-12T11:57:07.413-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-08-11T03:01:30.000-04:00

CONFIRM http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14468.html MISC https://nealpoole.com/blog/2013/07/code-execution-via-f5-networks-java-applet/ Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.

cpe:/o:xen:xen:4.2.0:-:~~~~x86~ cpe:/o:xen:xen:4.2.1:-:~~~~x86~

CVE-2013-0151

2013-03-07T00:04:42.060-05:00

2013-10-10T23:48:23.183-04:00

4.6

ADJACENT_NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov MLIST [oss-security] 20130122 Xen Security Advisory 34 (CVE-2013-0151) - nested virtualization on 32-bit exposes host crash GENTOO GLSA-201309-24 CONFIRM http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=d60d7082289a74e44b3dc8f67df46c3404ca08bf The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not prevent HVM_PARAM_NESTEDHVM (aka nested virtualization) operations, which allows guest OS users to cause a denial of service (long-duration page mappings and host OS crash) by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs.

cpe:/o:xen:xen:4.2.0

CVE-2013-0152

2013-02-12T20:55:03.247-05:00

2013-10-10T23:48:23.260-04:00

4.7

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov GENTOO GLSA-201309-24 MLIST [oss-security] 20130123 Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest SECTRACK 1028032 Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service (host memory consumption) by performing nested virtualization in a way that triggers errors that are not properly handled.

cpe:/o:xen:xen:3.3.0 cpe:/o:xen:xen:4.1.0 cpe:/o:xen:xen:4.1.1 cpe:/o:xen:xen:4.1.2 cpe:/o:xen:xen:4.1.3 cpe:/o:xen:xen:4.1.4 cpe:/o:xen:xen:4.2.0 cpe:/o:xen:xen:4.2.1

CVE-2013-0153

2013-02-14T17:55:02.653-05:00

2017-08-28T21:32:59.480-04:00

4.7

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2014:0446 SUSE openSUSE-SU-2013:0636 SUSE openSUSE-SU-2013:0637 SUSE openSUSE-SU-2013:0912 REDHAT RHSA-2013:0847 GENTOO GLSA-201309-24 DEBIAN DSA-2636 MLIST [oss-security] 20130205 Xen Security Advisory 36 (CVE-2013-0153) - interrupt remap entries shared and old ones not cleared on AMD IOMMUs BID 57745 XF xen-amdiommu-dos(81831) The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.

cpe:/o:xen:xen:4.2.0

CVE-2013-0154

2013-01-11T23:33:49.337-05:00

2017-08-28T21:32:59.543-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2014:0446 SUSE openSUSE-SU-2013:0636 SUSE openSUSE-SU-2013:0637 CONFIRM http://seclists.org/oss-sec/2013/q1/att-17/xsa37-4_2.patch GENTOO GLSA-201309-24 MLIST [oss-security] 20130104 Xen Security Advisory 37 (CVE-2013-0154) - Hypervisor crash due to incorrect ASSERT (debug build only) BID 57159 SECTRACK 1027937 XF xen-hypercall-dos(80977) The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall.

CVE-2013-0155

2013-01-13T17:55:00.900-05:00

2019-08-08T11:42:48.277-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-12-04T12:18:49.207-05:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A APPLE APPLE-SA-2013-06-04-1 SUSE openSUSE-SU-2013:1904 SUSE openSUSE-SU-2013:1906 SUSE openSUSE-SU-2013:1907 SUSE openSUSE-SU-2014:0009 REDHAT RHSA-2013:0154 REDHAT RHSA-2013:0155 CONFIRM http://support.apple.com/kb/HT5784 DEBIAN DSA-2609 MLIST [rubyonrails-security] 20130108 Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155) CONFIRM https://puppet.com/security/cve/cve-2013-0155 Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

cpe:/a:rubyonrails:rails:3.2.0:- cpe:/a:rubyonrails:rails:3.2.0:rc1 cpe:/a:rubyonrails:rails:3.2.0:rc2 cpe:/a:rubyonrails:rails:3.2.1 cpe:/a:rubyonrails:rails:3.2.2:- cpe:/a:rubyonrails:rails:3.2.2:rc1 cpe:/a:rubyonrails:rails:3.2.3:- cpe:/a:rubyonrails:rails:3.2.3:rc1 cpe:/a:rubyonrails:rails:3.2.3:rc2 cpe:/a:rubyonrails:rails:3.2.4:- cpe:/a:rubyonrails:rails:3.2.4:rc1 cpe:/a:rubyonrails:rails:3.2.5 cpe:/a:rubyonrails:rails:3.2.6 cpe:/a:rubyonrails:rails:3.2.7:- cpe:/a:rubyonrails:rails:3.2.7:rc1 cpe:/a:rubyonrails:rails:3.2.8:- cpe:/a:rubyonrails:rails:3.2.8:rc1 cpe:/a:rubyonrails:rails:3.2.8:rc2 cpe:/a:rubyonrails:rails:3.2.9:- cpe:/a:rubyonrails:rails:3.2.9:rc1 cpe:/a:rubyonrails:rails:3.2.9:rc2 cpe:/a:rubyonrails:rails:3.2.9:rc3 cpe:/a:rubyonrails:rails:3.2.10 cpe:/a:rubyonrails:ruby_on_rails:0.5.0 cpe:/a:rubyonrails:ruby_on_rails:0.5.5 cpe:/a:rubyonrails:ruby_on_rails:0.5.6 cpe:/a:rubyonrails:ruby_on_rails:0.5.7 cpe:/a:rubyonrails:ruby_on_rails:0.6.0 cpe:/a:rubyonrails:ruby_on_rails:0.6.5 cpe:/a:rubyonrails:ruby_on_rails:0.7.0 cpe:/a:rubyonrails:ruby_on_rails:0.8.0 cpe:/a:rubyonrails:ruby_on_rails:0.8.5 cpe:/a:rubyonrails:ruby_on_rails:0.9.0 cpe:/a:rubyonrails:ruby_on_rails:0.9.1 cpe:/a:rubyonrails:ruby_on_rails:0.9.2 cpe:/a:rubyonrails:ruby_on_rails:0.9.3 cpe:/a:rubyonrails:ruby_on_rails:0.9.4 cpe:/a:rubyonrails:ruby_on_rails:0.9.4.1 cpe:/a:rubyonrails:ruby_on_rails:0.10.0 cpe:/a:rubyonrails:ruby_on_rails:0.10.1 cpe:/a:rubyonrails:ruby_on_rails:0.11.0 cpe:/a:rubyonrails:ruby_on_rails:0.11.1 cpe:/a:rubyonrails:ruby_on_rails:0.12.0 cpe:/a:rubyonrails:ruby_on_rails:0.12.1 cpe:/a:rubyonrails:ruby_on_rails:0.13.0 cpe:/a:rubyonrails:ruby_on_rails:0.13.1 cpe:/a:rubyonrails:ruby_on_rails:0.14.1 cpe:/a:rubyonrails:ruby_on_rails:0.14.2 cpe:/a:rubyonrails:ruby_on_rails:0.14.3 cpe:/a:rubyonrails:ruby_on_rails:0.14.4 cpe:/a:rubyonrails:ruby_on_rails:1.0.0 cpe:/a:rubyonrails:ruby_on_rails:1.1.0 cpe:/a:rubyonrails:ruby_on_rails:1.1.1 cpe:/a:rubyonrails:ruby_on_rails:1.1.2 cpe:/a:rubyonrails:ruby_on_rails:1.1.3 cpe:/a:rubyonrails:ruby_on_rails:1.1.4 cpe:/a:rubyonrails:ruby_on_rails:1.1.5 cpe:/a:rubyonrails:ruby_on_rails:1.1.6 cpe:/a:rubyonrails:ruby_on_rails:1.2.0 cpe:/a:rubyonrails:ruby_on_rails:1.2.1 cpe:/a:rubyonrails:ruby_on_rails:1.2.2 cpe:/a:rubyonrails:ruby_on_rails:1.2.3 cpe:/a:rubyonrails:ruby_on_rails:1.2.4 cpe:/a:rubyonrails:ruby_on_rails:1.2.5 cpe:/a:rubyonrails:ruby_on_rails:1.2.6 cpe:/a:rubyonrails:ruby_on_rails:1.9.3 cpe:/a:rubyonrails:ruby_on_rails:1.9.5 cpe:/a:rubyonrails:ruby_on_rails:2.0.0 cpe:/a:rubyonrails:ruby_on_rails:2.0.0:rc1 cpe:/a:rubyonrails:ruby_on_rails:2.0.0:rc2 cpe:/a:rubyonrails:ruby_on_rails:2.0.1 cpe:/a:rubyonrails:ruby_on_rails:2.0.2 cpe:/a:rubyonrails:ruby_on_rails:2.0.4 cpe:/a:rubyonrails:ruby_on_rails:2.1 cpe:/a:rubyonrails:ruby_on_rails:2.1.0 cpe:/a:rubyonrails:ruby_on_rails:2.1.1 cpe:/a:rubyonrails:ruby_on_rails:2.1.2 cpe:/a:rubyonrails:ruby_on_rails:2.2.0 cpe:/a:rubyonrails:ruby_on_rails:2.2.1 cpe:/a:rubyonrails:ruby_on_rails:2.2.2 cpe:/a:rubyonrails:ruby_on_rails:2.3.0 cpe:/a:rubyonrails:ruby_on_rails:2.3.1 cpe:/a:rubyonrails:ruby_on_rails:2.3.2 cpe:/a:rubyonrails:ruby_on_rails:2.3.3 cpe:/a:rubyonrails:ruby_on_rails:2.3.4 cpe:/a:rubyonrails:ruby_on_rails:2.3.9 cpe:/a:rubyonrails:ruby_on_rails:2.3.10 cpe:/a:rubyonrails:ruby_on_rails:2.3.11 cpe:/a:rubyonrails:ruby_on_rails:2.3.12 cpe:/a:rubyonrails:ruby_on_rails:2.3.13 cpe:/a:rubyonrails:ruby_on_rails:2.3.14 cpe:/a:rubyonrails:ruby_on_rails:3.0.0 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta2 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta3 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta4 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.1 cpe:/a:rubyonrails:ruby_on_rails:3.0.1:pre cpe:/a:rubyonrails:ruby_on_rails:3.0.2 cpe:/a:rubyonrails:ruby_on_rails:3.0.2:pre cpe:/a:rubyonrails:ruby_on_rails:3.0.3 cpe:/a:rubyonrails:ruby_on_rails:3.0.4 cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.5 cpe:/a:rubyonrails:ruby_on_rails:3.0.5:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.6 cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.7 cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.8 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.0.9 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc5 cpe:/a:rubyonrails:ruby_on_rails:3.0.10 cpe:/a:rubyonrails:ruby_on_rails:3.0.10:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.11 cpe:/a:rubyonrails:ruby_on_rails:3.0.12 cpe:/a:rubyonrails:ruby_on_rails:3.0.12:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.13 cpe:/a:rubyonrails:ruby_on_rails:3.0.13:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.14 cpe:/a:rubyonrails:ruby_on_rails:3.0.16 cpe:/a:rubyonrails:ruby_on_rails:3.0.17 cpe:/a:rubyonrails:ruby_on_rails:3.0.18 cpe:/a:rubyonrails:ruby_on_rails:3.1.0 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc5 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc6 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc7 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc8 cpe:/a:rubyonrails:ruby_on_rails:3.1.1 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.1.2 cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.2rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.3 cpe:/a:rubyonrails:ruby_on_rails:3.1.4 cpe:/a:rubyonrails:ruby_on_rails:3.1.4:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.5 cpe:/a:rubyonrails:ruby_on_rails:3.1.5:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.6 cpe:/a:rubyonrails:ruby_on_rails:3.1.7 cpe:/a:rubyonrails:ruby_on_rails:3.1.8 cpe:/a:rubyonrails:ruby_on_rails:3.1.9 cpe:/o:debian:debian_linux:6.0 cpe:/o:debian:debian_linux:7.0

CVE-2013-0156

2013-01-13T17:55:00.947-05:00

2019-08-08T11:42:48.277-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-12-04T12:21:55.523-05:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A APPLE APPLE-SA-2013-03-14-1 REDHAT RHSA-2013:0153 REDHAT RHSA-2013:0154 REDHAT RHSA-2013:0155 CONFIRM http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/ DEBIAN DSA-2604 CONFIRM http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html MISC http://www.insinuator.net/2013/01/rails-yaml/ CERT-VN VU#380039 CERT-VN VU#628463 MISC https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156 MLIST [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) CONFIRM https://puppet.com/security/cve/cve-2013-0156 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

cpe:/a:kernel:util-linux:2.14.1 cpe:/a:kernel:util-linux:2.17.2

CVE-2013-0157

2014-01-21T13:55:09.007-05:00

2014-01-22T15:26:30.923-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-01-22T15:26:30.843-05:00

CONFIRM http://bugs.debian.org/697464 MLIST [oss-security] 20130106 Re: CVE request: mount/umount leak information about existence of folders REDHAT RHSA-2013:0517 MANDRIVA MDVSA-2013:154 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=892330 (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.

cpe:/a:cloudbees:jenkins:1.400:-:lts cpe:/a:cloudbees:jenkins:1.424:-:lts cpe:/a:cloudbees:jenkins:1.447:-:lts cpe:/a:cloudbees:jenkins:1.447.1.1:-:enterprise cpe:/a:cloudbees:jenkins:1.447.2.2:-:enterprise cpe:/a:cloudbees:jenkins:1.447.3.1:-:enterprise cpe:/a:cloudbees:jenkins:1.466.1.2:-:enterprise cpe:/a:cloudbees:jenkins:1.466.2.1:-:enterprise cpe:/a:cloudbees:jenkins:1.480.3.1 cpe:/a:jenkins:jenkins:1.400 cpe:/a:jenkins:jenkins:1.401 cpe:/a:jenkins:jenkins:1.402 cpe:/a:jenkins:jenkins:1.403 cpe:/a:jenkins:jenkins:1.404 cpe:/a:jenkins:jenkins:1.405 cpe:/a:jenkins:jenkins:1.406 cpe:/a:jenkins:jenkins:1.407 cpe:/a:jenkins:jenkins:1.408 cpe:/a:jenkins:jenkins:1.409 cpe:/a:jenkins:jenkins:1.409.1 cpe:/a:jenkins:jenkins:1.409.2 cpe:/a:jenkins:jenkins:1.409.3 cpe:/a:jenkins:jenkins:1.410 cpe:/a:jenkins:jenkins:1.411 cpe:/a:jenkins:jenkins:1.412 cpe:/a:jenkins:jenkins:1.413 cpe:/a:jenkins:jenkins:1.414 cpe:/a:jenkins:jenkins:1.415 cpe:/a:jenkins:jenkins:1.416 cpe:/a:jenkins:jenkins:1.417 cpe:/a:jenkins:jenkins:1.418 cpe:/a:jenkins:jenkins:1.419 cpe:/a:jenkins:jenkins:1.420 cpe:/a:jenkins:jenkins:1.421 cpe:/a:jenkins:jenkins:1.422 cpe:/a:jenkins:jenkins:1.423 cpe:/a:jenkins:jenkins:1.424 cpe:/a:jenkins:jenkins:1.424.1 cpe:/a:jenkins:jenkins:1.424.2 cpe:/a:jenkins:jenkins:1.424.3 cpe:/a:jenkins:jenkins:1.424.4 cpe:/a:jenkins:jenkins:1.424.5 cpe:/a:jenkins:jenkins:1.424.6 cpe:/a:jenkins:jenkins:1.425 cpe:/a:jenkins:jenkins:1.426 cpe:/a:jenkins:jenkins:1.427 cpe:/a:jenkins:jenkins:1.428 cpe:/a:jenkins:jenkins:1.429 cpe:/a:jenkins:jenkins:1.430 cpe:/a:jenkins:jenkins:1.431 cpe:/a:jenkins:jenkins:1.432 cpe:/a:jenkins:jenkins:1.433 cpe:/a:jenkins:jenkins:1.434 cpe:/a:jenkins:jenkins:1.435 cpe:/a:jenkins:jenkins:1.436 cpe:/a:jenkins:jenkins:1.437 cpe:/a:jenkins:jenkins:1.447.1 cpe:/a:jenkins:jenkins:1.447.2 cpe:/a:jenkins:jenkins:1.466.1 cpe:/a:jenkins:jenkins:1.466.2

CVE-2013-0158

2013-02-24T17:55:01.253-05:00

2018-10-30T12:27:19.920-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-15T09:50:01.567-04:00

REDHAT RHSA-2013:0220 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cb MLIST [oss-security] 20130107 Re: CVE Request: Jenkins possible remote code execution MISC https://bugzilla.redhat.com/show_bug.cgi?id=892795 CONFIRM https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04 CONFIRM https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5 CONFIRM https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602 CONFIRM https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fd CONFIRM https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04 Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.

cpe:/o:fedoraproject:fedora:17 cpe:/o:fedoraproject:fedora:18

CVE-2013-0159

2018-05-01T15:29:00.373-04:00

2018-06-13T12:51:43.930-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-06-05T15:38:12.673-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=892299 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=892815 The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9

CVE-2013-0160

2013-02-17T23:41:50.277-05:00

2017-11-28T21:29:00.527-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2013:0395 SUSE SUSE-SU-2013:0674 SUSE openSUSE-SU-2013:0925 SUSE SUSE-SU-2013:1182 SUSE openSUSE-SU-2013:1187 MLIST [oss-security] 20130107 Re: /dev/ptmx timing UBUNTU USN-2128-1 UBUNTU USN-2129-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=892983 The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.

cpe:/a:ryan_davis:ruby_parser:1.0.0 cpe:/a:ryan_davis:ruby_parser:2.0.0 cpe:/a:ryan_davis:ruby_parser:2.0.1 cpe:/a:ryan_davis:ruby_parser:2.0.2 cpe:/a:ryan_davis:ruby_parser:2.0.3 cpe:/a:ryan_davis:ruby_parser:2.0.4 cpe:/a:ryan_davis:ruby_parser:2.0.5 cpe:/a:ryan_davis:ruby_parser:2.0.6 cpe:/a:ryan_davis:ruby_parser:2.1.0 cpe:/a:ryan_davis:ruby_parser:2.2.0 cpe:/a:ryan_davis:ruby_parser:2.3.0 cpe:/a:ryan_davis:ruby_parser:2.3.1 cpe:/a:ryan_davis:ruby_parser:3.0.0 cpe:/a:ryan_davis:ruby_parser:3.0.0.a1 cpe:/a:ryan_davis:ruby_parser:3.0.0.a2 cpe:/a:ryan_davis:ruby_parser:3.0.0.a3 cpe:/a:ryan_davis:ruby_parser:3.0.0.a4 cpe:/a:ryan_davis:ruby_parser:3.0.0.a5 cpe:/a:ryan_davis:ruby_parser:3.0.0.a6 cpe:/a:ryan_davis:ruby_parser:3.0.0.a7 cpe:/a:ryan_davis:ruby_parser:3.0.0.a8 cpe:/a:ryan_davis:ruby_parser:3.0.0.a9 cpe:/a:ryan_davis:ruby_parser:3.0.0.a10 cpe:/a:ryan_davis:ruby_parser:3.0.1 cpe:/a:ryan_davis:ruby_parser:3.0.2 cpe:/a:ryan_davis:ruby_parser:3.0.3 cpe:/a:ryan_davis:ruby_parser:3.0.4 cpe:/a:ryan_davis:ruby_parser:3.1.0 cpe:/a:ryan_davis:ruby_parser:3.1.1

CVE-2013-0162

2013-03-01T00:40:16.987-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-01T11:32:00.000-05:00

REDHAT RHSA-2013:0544 REDHAT RHSA-2013:0548 MISC https://bugzilla.redhat.com/show_bug.cgi?id=892806 The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

cpe:/a:redhat:openshift:1.0:-:enterprise cpe:/a:redhat:openshift_origin:1.0.5

CVE-2013-0164

2013-02-24T17:55:01.300-05:00

2013-02-25T00:00:00.000-05:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-02-25T15:24:00.000-05:00

REDHAT RHSA-2013:0220 MISC https://bugzilla.redhat.com/show_bug.cgi?id=893307 CONFIRM https://github.com/openshift/origin-server/commit/524465f70a32d0eb6bf047e6a05c76c22d52bfa2 CONFIRM https://github.com/openshift/origin-server/pull/1136 The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

cpe:/a:openssl:openssl:0.9.1c cpe:/a:openssl:openssl:0.9.2b cpe:/a:openssl:openssl:0.9.3 cpe:/a:openssl:openssl:0.9.3a cpe:/a:openssl:openssl:0.9.4 cpe:/a:openssl:openssl:0.9.5 cpe:/a:openssl:openssl:0.9.5:beta1 cpe:/a:openssl:openssl:0.9.5:beta2 cpe:/a:openssl:openssl:0.9.5a cpe:/a:openssl:openssl:0.9.5a:beta1 cpe:/a:openssl:openssl:0.9.5a:beta2 cpe:/a:openssl:openssl:0.9.6 cpe:/a:openssl:openssl:0.9.6:beta1 cpe:/a:openssl:openssl:0.9.6:beta2 cpe:/a:openssl:openssl:0.9.6:beta3 cpe:/a:openssl:openssl:0.9.6a cpe:/a:openssl:openssl:0.9.6a:beta1 cpe:/a:openssl:openssl:0.9.6a:beta2 cpe:/a:openssl:openssl:0.9.6a:beta3 cpe:/a:openssl:openssl:0.9.6b cpe:/a:openssl:openssl:0.9.6c cpe:/a:openssl:openssl:0.9.6d cpe:/a:openssl:openssl:0.9.6e cpe:/a:openssl:openssl:0.9.6f cpe:/a:openssl:openssl:0.9.6g cpe:/a:openssl:openssl:0.9.6h cpe:/a:openssl:openssl:0.9.6i cpe:/a:openssl:openssl:0.9.6j cpe:/a:openssl:openssl:0.9.6k cpe:/a:openssl:openssl:0.9.6l cpe:/a:openssl:openssl:0.9.6m cpe:/a:openssl:openssl:0.9.7 cpe:/a:openssl:openssl:0.9.7:beta1 cpe:/a:openssl:openssl:0.9.7:beta2 cpe:/a:openssl:openssl:0.9.7:beta3 cpe:/a:openssl:openssl:0.9.7:beta4 cpe:/a:openssl:openssl:0.9.7:beta5 cpe:/a:openssl:openssl:0.9.7:beta6 cpe:/a:openssl:openssl:0.9.7a cpe:/a:openssl:openssl:0.9.7b cpe:/a:openssl:openssl:0.9.7c cpe:/a:openssl:openssl:0.9.7d cpe:/a:openssl:openssl:0.9.7e cpe:/a:openssl:openssl:0.9.7f cpe:/a:openssl:openssl:0.9.7g cpe:/a:openssl:openssl:0.9.7h cpe:/a:openssl:openssl:0.9.7i cpe:/a:openssl:openssl:0.9.7j cpe:/a:openssl:openssl:0.9.7k cpe:/a:openssl:openssl:0.9.7l cpe:/a:openssl:openssl:0.9.7m cpe:/a:openssl:openssl:0.9.8 cpe:/a:openssl:openssl:0.9.8a cpe:/a:openssl:openssl:0.9.8b cpe:/a:openssl:openssl:0.9.8c cpe:/a:openssl:openssl:0.9.8d cpe:/a:openssl:openssl:0.9.8e cpe:/a:openssl:openssl:0.9.8f cpe:/a:openssl:openssl:0.9.8g cpe:/a:openssl:openssl:0.9.8h cpe:/a:openssl:openssl:0.9.8i cpe:/a:openssl:openssl:0.9.8j cpe:/a:openssl:openssl:0.9.8k cpe:/a:openssl:openssl:0.9.8l cpe:/a:openssl:openssl:0.9.8m cpe:/a:openssl:openssl:0.9.8m:beta1 cpe:/a:openssl:openssl:0.9.8n cpe:/a:openssl:openssl:0.9.8o cpe:/a:openssl:openssl:0.9.8p cpe:/a:openssl:openssl:0.9.8q cpe:/a:openssl:openssl:0.9.8r cpe:/a:openssl:openssl:0.9.8s cpe:/a:openssl:openssl:0.9.8t cpe:/a:openssl:openssl:0.9.8u cpe:/a:openssl:openssl:0.9.8v cpe:/a:openssl:openssl:0.9.8w cpe:/a:openssl:openssl:0.9.8x cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:redhat:openssl:0.9.6-15 cpe:/a:redhat:openssl:0.9.6b-3 cpe:/a:redhat:openssl:0.9.7a-2

CVE-2013-0166

2013-02-08T14:55:00.967-05:00

2018-08-08T21:29:00.530-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7 CONFIRM http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=66e8211c0b1347970096e04b18aa52567c325200 CONFIRM http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ebc71865f0506a293242bd4aec97cdc7a8ef24b0 APPLE APPLE-SA-2013-09-12-1 SUSE SUSE-SU-2015:0578 SUSE openSUSE-SU-2016:0640 HP HPSBUX02856 HP SSRT101108 HP SSRT101289 REDHAT RHSA-2013:0587 REDHAT RHSA-2013:0782 REDHAT RHSA-2013:0783 REDHAT RHSA-2013:0833 CONFIRM http://support.apple.com/kb/HT5880 DEBIAN DSA-2621 CERT-VN VU#737740 CONFIRM http://www.openssl.org/news/secadv_20130204.txt CONFIRM http://www.splunk.com/view/SP-CAAAHXG CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=908052 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001 OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

cpe:/a:redhat:enterprise_virtualization:3.0 cpe:/a:redhat:enterprise_virtualization:3.2

CVE-2013-0167

2013-08-19T19:55:08.197-04:00

2013-08-20T10:22:04.267-04:00

2.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2013-08-20T02:05:15.000-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=893332 REDHAT RHSA-2013:0886 REDHAT RHSA-2013:0907 VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."

cpe:/a:redhat:enterprise_virtualization_manager:2.1 cpe:/a:redhat:enterprise_virtualization_manager:2.2 cpe:/a:redhat:enterprise_virtualization_manager:2.2.3 cpe:/a:redhat:enterprise_virtualization_manager:3.0 cpe:/a:redhat:enterprise_virtualization_manager:3.1

CVE-2013-0168

2013-03-12T19:55:01.667-04:00

2017-08-28T21:32:59.603-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0211 BID 57750 SECTRACK 1028076 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=893355 XF entreprise-movedisk-dos(81834) The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.

cpe:/a:openssl:openssl:0.9.8 cpe:/a:openssl:openssl:0.9.8:beta1 cpe:/a:openssl:openssl:0.9.8:beta2 cpe:/a:openssl:openssl:0.9.8:beta3 cpe:/a:openssl:openssl:0.9.8:beta4 cpe:/a:openssl:openssl:0.9.8:beta5 cpe:/a:openssl:openssl:0.9.8:beta6 cpe:/a:openssl:openssl:0.9.8a cpe:/a:openssl:openssl:0.9.8b cpe:/a:openssl:openssl:0.9.8c cpe:/a:openssl:openssl:0.9.8d cpe:/a:openssl:openssl:0.9.8e cpe:/a:openssl:openssl:0.9.8f cpe:/a:openssl:openssl:0.9.8g cpe:/a:openssl:openssl:0.9.8h cpe:/a:openssl:openssl:0.9.8i cpe:/a:openssl:openssl:0.9.8j cpe:/a:openssl:openssl:0.9.8k cpe:/a:openssl:openssl:0.9.8l cpe:/a:openssl:openssl:0.9.8m cpe:/a:openssl:openssl:0.9.8m:beta1 cpe:/a:openssl:openssl:0.9.8n cpe:/a:openssl:openssl:0.9.8o cpe:/a:openssl:openssl:0.9.8p cpe:/a:openssl:openssl:0.9.8q cpe:/a:openssl:openssl:0.9.8r cpe:/a:openssl:openssl:0.9.8s cpe:/a:openssl:openssl:0.9.8t cpe:/a:openssl:openssl:0.9.8u cpe:/a:openssl:openssl:0.9.8v cpe:/a:openssl:openssl:0.9.8w cpe:/a:openssl:openssl:0.9.8x cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:oracle:openjdk:- cpe:/a:oracle:openjdk:1.6.0 cpe:/a:oracle:openjdk:1.7.0 cpe:/a:oracle:openjdk:1.8.0 cpe:/a:polarssl:polarssl:0.10.0 cpe:/a:polarssl:polarssl:0.10.1 cpe:/a:polarssl:polarssl:0.11.0 cpe:/a:polarssl:polarssl:0.11.1 cpe:/a:polarssl:polarssl:0.12.0 cpe:/a:polarssl:polarssl:0.12.1 cpe:/a:polarssl:polarssl:0.13.1 cpe:/a:polarssl:polarssl:0.14.0 cpe:/a:polarssl:polarssl:0.14.2 cpe:/a:polarssl:polarssl:0.14.3 cpe:/a:polarssl:polarssl:0.99:pre1 cpe:/a:polarssl:polarssl:0.99:pre3 cpe:/a:polarssl:polarssl:0.99:pre4 cpe:/a:polarssl:polarssl:0.99:pre5 cpe:/a:polarssl:polarssl:1.0.0 cpe:/a:polarssl:polarssl:1.1.0 cpe:/a:polarssl:polarssl:1.1.0:rc0 cpe:/a:polarssl:polarssl:1.1.0:rc1 cpe:/a:polarssl:polarssl:1.1.1 cpe:/a:polarssl:polarssl:1.1.2 cpe:/a:polarssl:polarssl:1.1.3 cpe:/a:polarssl:polarssl:1.1.4

CVE-2013-0169

2013-02-08T14:55:01.030-05:00

2019-10-09T19:06:34.343-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/ APPLE APPLE-SA-2013-09-12-1 FEDORA FEDORA-2013-4403 SUSE SUSE-SU-2013:0328 SUSE openSUSE-SU-2013:0375 SUSE openSUSE-SU-2013:0378 SUSE SUSE-SU-2013:0701 SUSE SUSE-SU-2014:0320 SUSE SUSE-SU-2015:0578 SUSE openSUSE-SU-2016:0640 HP HPSBUX02856 HP SSRT101108 HP HPSBUX02857 HP HPSBMU02874 HP SSRT101289 MLIST [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations REDHAT RHSA-2013:0587 REDHAT RHSA-2013:0782 REDHAT RHSA-2013:0783 REDHAT RHSA-2013:0833 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CONFIRM http://support.apple.com/kb/HT5880 DEBIAN DSA-2621 DEBIAN DSA-2622 MISC http://www.isg.rhul.ac.uk/tls/TLStiming.pdf CERT-VN VU#737740 MANDRIVA MDVSA-2013:095 CONFIRM http://www.matrixssl.org/news.html CONFIRM http://www.openssl.org/news/secadv_20130204.txt CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html BID 57778 SECTRACK 1029190 CONFIRM http://www.splunk.com/view/SP-CAAAHXG UBUNTU USN-1735-1 CERT TA13-051A CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21644047 CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf MLIST [debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update CONFIRM https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released CONFIRM https://puppet.com/security/cve/cve-2013-0169 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

cpe:/a:redhat:libvirt::0.9.11 cpe:/a:redhat:libvirt::0.9.11.1 cpe:/a:redhat:libvirt::0.9.11.2 cpe:/a:redhat:libvirt::0.9.11.3 cpe:/a:redhat:libvirt::0.9.11.4 cpe:/a:redhat:libvirt::0.9.11.5 cpe:/a:redhat:libvirt::0.9.11.6 cpe:/a:redhat:libvirt::0.9.11.7 cpe:/a:redhat:libvirt::0.9.11.8 cpe:/a:redhat:libvirt:0.9.6 cpe:/a:redhat:libvirt:0.9.6.1 cpe:/a:redhat:libvirt:0.9.6.2 cpe:/a:redhat:libvirt:0.9.6.3 cpe:/a:redhat:libvirt:0.10.2 cpe:/a:redhat:libvirt:0.10.2.1 cpe:/a:redhat:libvirt:0.10.2.2 cpe:/a:redhat:libvirt:1.0.0 cpe:/a:redhat:libvirt:1.0.1 cpe:/a:suse:suse_linux_enterprise_software_development_kit:11.0:sp2 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:fedoraproject:fedora:17 cpe:/o:fedoraproject:fedora:18 cpe:/o:novell:suse_linux:11::desktop cpe:/o:novell:suse_linux:11::server cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0170

2013-02-08T15:55:01.297-05:00

2019-04-22T13:48:00.643-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://libvirt.org/git/?p=libvirt.git;a=commit;h=46532e3e8ed5f5a736a02f67d6c805492f9ca720 CONFIRM http://libvirt.org/news.html FEDORA FEDORA-2013-1644 FEDORA FEDORA-2013-1642 FEDORA FEDORA-2013-1626 SUSE openSUSE-SU-2013:0274 SUSE openSUSE-SU-2013:0275 SUSE SUSE-SU-2013:0320 REDHAT RHSA-2013:0199 CONFIRM http://wiki.libvirt.org/page/Maintenance_Releases BID 57578 SECTRACK 1028047 UBUNTU USN-1708-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=893450 XF libvirt-virnetmessagefree-code-exec(81552) Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

cpe:/a:theforeman:foreman:1.0

CVE-2013-0171

2014-05-08T10:29:07.330-04:00

2014-05-08T10:52:14.163-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-05-08T10:52:13.943-04:00

CONFIRM http://projects.theforeman.org/issues/2069 CONFIRM http://theforeman.org/security.html Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.

cpe:/a:samba:samba:4.0.0

CVE-2013-0172

2013-01-17T16:55:00.947-05:00

2013-01-18T00:00:00.000-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-01-18T13:58:00.000-05:00

CONFIRM http://www.samba.org/samba/security/CVE-2013-0172 Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.

cpe:/a:theforeman:foreman:1.0

CVE-2013-0173

2014-05-08T10:29:07.393-04:00

2014-05-08T10:59:05.507-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-08T06:56:57.000-04:00

CONFIRM http://projects.theforeman.org/issues/2069 CONFIRM http://theforeman.org/security.html Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.

cpe:/a:theforeman:foreman:1.0

CVE-2013-0174

2014-05-08T10:29:07.457-04:00

2014-05-08T10:58:21.643-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-08T10:58:21.410-04:00

CONFIRM http://projects.theforeman.org/issues/2069 CONFIRM http://theforeman.org/security.html The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.

cpe:/a:erik_michaels-ober:multi_xml:0.5.2 cpe:/a:grape_project:grape:0.1.0 cpe:/a:grape_project:grape:0.1.1 cpe:/a:grape_project:grape:0.1.2 cpe:/a:grape_project:grape:0.1.3 cpe:/a:grape_project:grape:0.1.4 cpe:/a:grape_project:grape:0.1.5 cpe:/a:grape_project:grape:0.2.0 cpe:/a:grape_project:grape:0.2.1 cpe:/a:grape_project:grape:0.2.2 cpe:/a:grape_project:grape:0.2.3 cpe:/a:grape_project:grape:0.2.4 cpe:/a:grape_project:grape:0.2.5

CVE-2013-0175

2013-04-25T19:55:01.410-04:00

2018-08-13T17:47:43.417-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20130111 Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) CONFIRM https://gist.github.com/nate/d7f6d9f4925f413621aa CONFIRM https://github.com/sferik/multi_xml/pull/34 CONFIRM https://groups.google.com/forum/?fromgroups=#!topic/ruby-grape/fthDkMgIOa0 MISC https://news.ycombinator.com/item?id=5040457 multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

cpe:/a:libssh:libssh:0.4.7 cpe:/a:libssh:libssh:0.4.8 cpe:/a:libssh:libssh:0.5.0 cpe:/a:libssh:libssh:0.5.0:rc1 cpe:/a:libssh:libssh:0.5.1 cpe:/a:libssh:libssh:0.5.2 cpe:/a:libssh:libssh:0.5.3

CVE-2013-0176

2013-02-05T18:55:01.850-05:00

2017-08-28T21:32:59.777-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2013-1422 FEDORA FEDORA-2013-1407 CONFIRM http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/ UBUNTU USN-1707-1 XF libssh-publickeyfromprivatekey-dos(81595) The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.

cpe:/a:apache:ofbiz:09.04 cpe:/a:apache:ofbiz:09.04.01 cpe:/a:apache:ofbiz:10.04 cpe:/a:apache:ofbiz:10.04.01 cpe:/a:apache:ofbiz:10.04.02 cpe:/a:apache:ofbiz:10.04.03 cpe:/a:apache:ofbiz:10.04.04 cpe:/a:apache:ofbiz:11.04.01

CVE-2013-0177

2014-01-30T10:06:22.657-05:00

2018-05-18T08:17:19.020-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-17T10:16:47.323-04:00

CONFIRM http://ofbiz.apache.org/download.html#vulnerabilities MISC http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html FULLDISC 20130118 [CVE-2013-0177] Cross-Site Scripting (XSS) Vulnerability in Apache OFBiz XF apache-ofbiz-xss(81398) CONFIRM https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395 CONFIRM https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850 Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

cpe:/a:memcached:memcached:1.4.4 cpe:/a:memcached:memcached:1.4.5 cpe:/a:memcached:memcached:1.4.6 cpe:/a:memcached:memcached:1.4.7 cpe:/a:memcached:memcached:1.4.8 cpe:/a:memcached:memcached:1.4.9 cpe:/a:memcached:memcached:1.4.10 cpe:/a:memcached:memcached:1.4.11 cpe:/a:memcached:memcached:1.4.12 cpe:/a:memcached:memcached:1.4.13 cpe:/a:memcached:memcached:1.4.14 cpe:/a:memcached:memcached:1.4.15 cpe:/a:memcached:memcached:1.4.16

CVE-2013-0179

2014-01-13T16:55:05.183-05:00

2018-03-24T21:29:00.367-04:00

1.8

ADJACENT_NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20130114 CVE request: memcached DoS when printing out keys to be deleted in verbose mode MLIST [oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode BID 64978 UBUNTU USN-2080-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=895054 CONFIRM https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096 CONFIRM https://code.google.com/p/memcached/issues/detail?id=306 CONFIRM https://code.google.com/p/memcached/wiki/ReleaseNotes1417 The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.

cpe:/a:thomas_seidl:search_api:7.x-1.0 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta1 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta10 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta2 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta3 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta4 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta5 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta6 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta7 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta8 cpe:/a:thomas_seidl:search_api:7.x-1.0:beta9 cpe:/a:thomas_seidl:search_api:7.x-1.0:rc1 cpe:/a:thomas_seidl:search_api:7.x-1.1 cpe:/a:thomas_seidl:search_api:7.x-1.2 cpe:/a:thomas_seidl:search_api:7.x-1.3 cpe:/a:thomas_seidl:search_api:7.x-1.x:dev

CVE-2013-0181

2013-03-27T17:55:01.477-04:00

2017-08-28T21:32:59.917-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://drupalcode.org/project/search_api.git/commitdiff/35b5728 MLIST [oss-security] 20130114 Re: CVE request for Drupal contributed modules BID 57231 CONFIRM https://drupal.org/node/1884076 MISC https://drupal.org/node/1884332 XF drupal-searchapi-unspecified-xss(81153) Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.

cpe:/a:bart_feenstra:payment::7.x-1.0 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha1 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha2 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha3 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha4 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha5 cpe:/a:bart_feenstra:payment::7.x-1.0:alpha6 cpe:/a:bart_feenstra:payment::7.x-1.0:beta1 cpe:/a:bart_feenstra:payment::7.x-1.0:beta2 cpe:/a:bart_feenstra:payment::7.x-1.0:beta3 cpe:/a:bart_feenstra:payment::7.x-1.1 cpe:/a:bart_feenstra:payment::7.x-1.2 cpe:/a:bart_feenstra:payment::7.x-1.x:dev

CVE-2013-0182

2013-03-27T17:55:02.107-04:00

2013-03-28T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T10:05:00.000-04:00

MISC http://drupal.org/node/1871508 CONFIRM http://drupal.org/node/1883830 CONFIRM http://drupalcode.org/project/payment.git/commitdiff/62c9186 MLIST [oss-security] 20130114 Re: CVE request for Drupal contributed modules MISC https://drupal.org/node/1884360 The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments.

cpe:/a:rack_project:rack:1.3.0 cpe:/a:rack_project:rack:1.3.1 cpe:/a:rack_project:rack:1.3.2 cpe:/a:rack_project:rack:1.3.3 cpe:/a:rack_project:rack:1.3.4 cpe:/a:rack_project:rack:1.3.5 cpe:/a:rack_project:rack:1.3.6 cpe:/a:rack_project:rack:1.3.7 cpe:/a:rack_project:rack:1.4.0 cpe:/a:rack_project:rack:1.4.1 cpe:/a:rack_project:rack:1.4.2

CVE-2013-0183

2013-03-01T00:40:17.037-05:00

2018-08-13T17:47:43.557-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2013:0462 CONFIRM http://rack.github.com/ REDHAT RHSA-2013:0544 REDHAT RHSA-2013:0548 DEBIAN DSA-2783 MISC https://bugzilla.redhat.com/show_bug.cgi?id=895282 CONFIRM https://github.com/rack/rack/commit/548b9af2dc0059f4c0c19728624448d84de450ff CONFIRM https://github.com/rack/rack/commit/f95113402b7239f225282806673e1b6424522b18 CONFIRM https://groups.google.com/forum/#!topic/rack-devel/7ZKPNAjgRSs CONFIRM https://groups.google.com/forum/#!topic/rack-devel/-MWPHDeGWtI multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

cpe:/a:rack_project:rack:1.1.0 cpe:/a:rack_project:rack:1.1.2 cpe:/a:rack_project:rack:1.1.3 cpe:/a:rack_project:rack:1.1.4 cpe:/a:rack_project:rack:1.2.0 cpe:/a:rack_project:rack:1.2.1 cpe:/a:rack_project:rack:1.2.2 cpe:/a:rack_project:rack:1.2.3 cpe:/a:rack_project:rack:1.2.4 cpe:/a:rack_project:rack:1.2.6 cpe:/a:rack_project:rack:1.3.0 cpe:/a:rack_project:rack:1.3.1 cpe:/a:rack_project:rack:1.3.2 cpe:/a:rack_project:rack:1.3.3 cpe:/a:rack_project:rack:1.3.4 cpe:/a:rack_project:rack:1.3.5 cpe:/a:rack_project:rack:1.3.6 cpe:/a:rack_project:rack:1.3.7 cpe:/a:rack_project:rack:1.3.8 cpe:/a:rack_project:rack:1.4.0 cpe:/a:rack_project:rack:1.4.1 cpe:/a:rack_project:rack:1.4.2 cpe:/a:rack_project:rack:1.4.3

CVE-2013-0184

2013-03-01T00:40:17.097-05:00

2013-10-30T23:30:51.263-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2013:0462 REDHAT RHSA-2013:0544 REDHAT RHSA-2013:0548 DEBIAN DSA-2783 MISC https://bugzilla.redhat.com/show_bug.cgi?id=895384 Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."

cpe:/a:redhat:manageiq_enterprise_virtualization_manager:-

CVE-2013-0185

2018-05-01T15:29:00.513-04:00

2018-06-13T10:13:40.533-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-06-05T16:32:33.983-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=895345 Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.

cpe:/a:theforeman:foreman:1.0

CVE-2013-0187

2014-05-08T10:29:07.533-04:00

2014-05-08T11:00:21.157-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-05-08T11:00:20.937-04:00

CONFIRM http://theforeman.org/security.html Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.

CVE-2013-0188

2013-10-04T19:55:03.407-04:00

2013-10-04T19:55:03.800-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:squid-cache:squid:3.1 cpe:/a:squid-cache:squid:3.1.0.1 cpe:/a:squid-cache:squid:3.1.0.2 cpe:/a:squid-cache:squid:3.1.0.3 cpe:/a:squid-cache:squid:3.1.0.4 cpe:/a:squid-cache:squid:3.1.0.5 cpe:/a:squid-cache:squid:3.1.0.6 cpe:/a:squid-cache:squid:3.1.0.7 cpe:/a:squid-cache:squid:3.1.0.8 cpe:/a:squid-cache:squid:3.1.0.9 cpe:/a:squid-cache:squid:3.1.0.10 cpe:/a:squid-cache:squid:3.1.0.11 cpe:/a:squid-cache:squid:3.1.0.12 cpe:/a:squid-cache:squid:3.1.0.13 cpe:/a:squid-cache:squid:3.1.0.14 cpe:/a:squid-cache:squid:3.1.0.15 cpe:/a:squid-cache:squid:3.1.0.16 cpe:/a:squid-cache:squid:3.1.0.17 cpe:/a:squid-cache:squid:3.1.0.18 cpe:/a:squid-cache:squid:3.1.1 cpe:/a:squid-cache:squid:3.1.2 cpe:/a:squid-cache:squid:3.1.3 cpe:/a:squid-cache:squid:3.1.4 cpe:/a:squid-cache:squid:3.1.5 cpe:/a:squid-cache:squid:3.1.5.1 cpe:/a:squid-cache:squid:3.1.6 cpe:/a:squid-cache:squid:3.1.7 cpe:/a:squid-cache:squid:3.1.8 cpe:/a:squid-cache:squid:3.1.9 cpe:/a:squid-cache:squid:3.1.10 cpe:/a:squid-cache:squid:3.1.11 cpe:/a:squid-cache:squid:3.1.12 cpe:/a:squid-cache:squid:3.1.13 cpe:/a:squid-cache:squid:3.1.14 cpe:/a:squid-cache:squid:3.1.15 cpe:/a:squid-cache:squid:3.1.22 cpe:/a:squid-cache:squid:3.2.0.1 cpe:/a:squid-cache:squid:3.2.0.2 cpe:/a:squid-cache:squid:3.2.0.3 cpe:/a:squid-cache:squid:3.2.0.4 cpe:/a:squid-cache:squid:3.2.0.5 cpe:/a:squid-cache:squid:3.2.0.6 cpe:/a:squid-cache:squid:3.2.0.7 cpe:/a:squid-cache:squid:3.2.0.8 cpe:/a:squid-cache:squid:3.2.0.9 cpe:/a:squid-cache:squid:3.2.0.10 cpe:/a:squid-cache:squid:3.2.0.11 cpe:/a:squid-cache:squid:3.2.0.12 cpe:/a:squid-cache:squid:3.2.0.13 cpe:/a:squid-cache:squid:3.2.0.14 cpe:/a:squid-cache:squid:3.2.0.15 cpe:/a:squid-cache:squid:3.2.0.16 cpe:/a:squid-cache:squid:3.2.0.17 cpe:/a:squid-cache:squid:3.2.0.18 cpe:/a:squid-cache:squid:3.2.0.19 cpe:/a:squid-cache:squid:3.2.1 cpe:/a:squid-cache:squid:3.2.2 cpe:/a:squid-cache:squid:3.2.3 cpe:/a:squid-cache:squid:3.2.4 cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0189

2013-02-08T15:55:01.377-05:00

2016-11-28T14:08:38.503-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743 CONFIRM http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744 MLIST [scm-commits] 20130125 [squid/f17] CVE-2013-0189: Incomplete fix for the CVE-2012-5643 SUSE SUSE-SU-2016:1996 SUSE SUSE-SU-2016:2089 SUSE openSUSE-SU-2013:1436 SUSE openSUSE-SU-2013:1443 DEBIAN DSA-2631 MANDRIVA MDVSA-2013:129 BID 57646 MISC http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2012_1.patch MISC http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2012_1.patch UBUNTU USN-1713-1 MISC https://bugzilla.redhat.com/show_bug.cgi?id=887962#c9 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=895972 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0029 cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.

cpe:/o:linux:linux_kernel:2.6.23

CVE-2013-0190

2013-02-12T20:55:03.307-05:00

2013-03-07T23:11:31.547-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2013:0496 MLIST [oss-security] 20130116 [PATCH] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests. MLIST [oss-security] 20130116 Xen Security Advisory 40 (CVE-2013-0190) - Linux stack corruption in xen_failsafe_callback for 32bit PVOPS guests. BID 57433 UBUNTU USN-1725-1 UBUNTU USN-1728-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=896038 The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.

cpe:/a:lucas_clemente_vella:libpam-pgsql:0.7

CVE-2013-0191

2014-06-03T10:55:09.037-04:00

2017-08-28T21:32:59.997-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2016:1996 SUSE SUSE-SU-2016:2089 MLIST [oss-security] 20130115 pam-pgsql NULL password handling issue MLIST [oss-security] 20130116 Re: pam-pgsql NULL password handling issue MISC http://sourceforge.net/p/pam-pgsql/bugs/13/ MISC http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/ BID 57440 XF libpampgsql-password-sec-bypass(81363) libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.

cpe:/a:mantisbt:mantisbt:1.2.12 cpe:/a:mantisbt:mantisbt:1.2.13

CVE-2013-0197

2014-05-15T10:55:06.653-04:00

2014-05-16T08:44:36.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-16T08:44:35.867-04:00

MISC http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html MLIST [oss-security] 20130118 CVE request: MantisBT before 1.2.13 match_type XSS vulnerability MLIST [oss-security] 20130118 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability MLIST [oss-security] 20130121 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability CONFIRM http://www.mantisbt.org/bugs/view.php?id=15373 Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.

cpe:/a:thekelleys:dnsmasq:- cpe:/a:thekelleys:dnsmasq:0.4 cpe:/a:thekelleys:dnsmasq:0.5 cpe:/a:thekelleys:dnsmasq:0.6 cpe:/a:thekelleys:dnsmasq:0.7 cpe:/a:thekelleys:dnsmasq:0.95 cpe:/a:thekelleys:dnsmasq:0.96 cpe:/a:thekelleys:dnsmasq:0.98 cpe:/a:thekelleys:dnsmasq:0.992 cpe:/a:thekelleys:dnsmasq:0.996 cpe:/a:thekelleys:dnsmasq:1.0 cpe:/a:thekelleys:dnsmasq:1.2 cpe:/a:thekelleys:dnsmasq:1.3 cpe:/a:thekelleys:dnsmasq:1.4 cpe:/a:thekelleys:dnsmasq:1.5 cpe:/a:thekelleys:dnsmasq:1.6 cpe:/a:thekelleys:dnsmasq:1.7 cpe:/a:thekelleys:dnsmasq:1.8 cpe:/a:thekelleys:dnsmasq:1.9 cpe:/a:thekelleys:dnsmasq:1.10 cpe:/a:thekelleys:dnsmasq:1.11 cpe:/a:thekelleys:dnsmasq:1.12 cpe:/a:thekelleys:dnsmasq:1.13 cpe:/a:thekelleys:dnsmasq:1.14 cpe:/a:thekelleys:dnsmasq:1.15 cpe:/a:thekelleys:dnsmasq:1.16 cpe:/a:thekelleys:dnsmasq:1.17 cpe:/a:thekelleys:dnsmasq:1.18 cpe:/a:thekelleys:dnsmasq:2.0 cpe:/a:thekelleys:dnsmasq:2.1 cpe:/a:thekelleys:dnsmasq:2.2 cpe:/a:thekelleys:dnsmasq:2.3 cpe:/a:thekelleys:dnsmasq:2.4 cpe:/a:thekelleys:dnsmasq:2.5 cpe:/a:thekelleys:dnsmasq:2.6 cpe:/a:thekelleys:dnsmasq:2.7 cpe:/a:thekelleys:dnsmasq:2.8 cpe:/a:thekelleys:dnsmasq:2.9 cpe:/a:thekelleys:dnsmasq:2.10 cpe:/a:thekelleys:dnsmasq:2.11 cpe:/a:thekelleys:dnsmasq:2.12 cpe:/a:thekelleys:dnsmasq:2.13 cpe:/a:thekelleys:dnsmasq:2.14 cpe:/a:thekelleys:dnsmasq:2.15 cpe:/a:thekelleys:dnsmasq:2.16 cpe:/a:thekelleys:dnsmasq:2.17 cpe:/a:thekelleys:dnsmasq:2.18 cpe:/a:thekelleys:dnsmasq:2.19 cpe:/a:thekelleys:dnsmasq:2.20 cpe:/a:thekelleys:dnsmasq:2.21 cpe:/a:thekelleys:dnsmasq:2.22 cpe:/a:thekelleys:dnsmasq:2.23 cpe:/a:thekelleys:dnsmasq:2.24 cpe:/a:thekelleys:dnsmasq:2.25 cpe:/a:thekelleys:dnsmasq:2.26 cpe:/a:thekelleys:dnsmasq:2.27 cpe:/a:thekelleys:dnsmasq:2.28 cpe:/a:thekelleys:dnsmasq:2.29 cpe:/a:thekelleys:dnsmasq:2.30 cpe:/a:thekelleys:dnsmasq:2.31 cpe:/a:thekelleys:dnsmasq:2.33 cpe:/a:thekelleys:dnsmasq:2.34 cpe:/a:thekelleys:dnsmasq:2.35 cpe:/a:thekelleys:dnsmasq:2.36 cpe:/a:thekelleys:dnsmasq:2.37 cpe:/a:thekelleys:dnsmasq:2.38 cpe:/a:thekelleys:dnsmasq:2.39 cpe:/a:thekelleys:dnsmasq:2.40 cpe:/a:thekelleys:dnsmasq:2.41 cpe:/a:thekelleys:dnsmasq:2.42 cpe:/a:thekelleys:dnsmasq:2.43 cpe:/a:thekelleys:dnsmasq:2.44 cpe:/a:thekelleys:dnsmasq:2.45 cpe:/a:thekelleys:dnsmasq:2.46 cpe:/a:thekelleys:dnsmasq:2.47 cpe:/a:thekelleys:dnsmasq:2.48 cpe:/a:thekelleys:dnsmasq:2.49 cpe:/a:thekelleys:dnsmasq:2.50 cpe:/a:thekelleys:dnsmasq:2.51 cpe:/a:thekelleys:dnsmasq:2.52 cpe:/a:thekelleys:dnsmasq:2.53 cpe:/a:thekelleys:dnsmasq:2.54 cpe:/a:thekelleys:dnsmasq:2.55 cpe:/a:thekelleys:dnsmasq:2.56 cpe:/a:thekelleys:dnsmasq:2.57 cpe:/a:thekelleys:dnsmasq:2.58 cpe:/a:thekelleys:dnsmasq:2.59 cpe:/a:thekelleys:dnsmasq:2.60 cpe:/a:thekelleys:dnsmasq:2.61 cpe:/a:thekelleys:dnsmasq:2.62 cpe:/a:thekelleys:dnsmasq:2.63 cpe:/a:thekelleys:dnsmasq:2.64 cpe:/a:thekelleys:dnsmasq:2.65

CVE-2013-0198

2013-03-05T16:38:54.827-05:00

2013-12-05T00:22:15.823-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:072 MLIST [oss-security] 20130118 CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue MLIST [oss-security] 20130118 Re: CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue CONFIRM http://www.thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=22ce550e5346947a12a781ed0959a7b1165d0dc6 MISC https://bugzilla.redhat.com/show_bug.cgi?id=894486 Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.

cpe:/a:redhat:freeipa:3.0.0 cpe:/a:redhat:freeipa:3.0.1 cpe:/a:redhat:freeipa:3.0.2 cpe:/a:redhat:freeipa:3.1.1

CVE-2013-0199

2014-05-29T10:19:06.863-04:00

2017-08-28T21:33:00.057-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.freeipa.org/page/CVE-2013-0199 CONFIRM http://www.freeipa.org/page/Releases/3.1.2 BID 57542 XF freeipa-crossrealm-info-disc(81486) The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.

cpe:/a:hp:linux_imaging_and_printing_project:1.0 cpe:/a:hp:linux_imaging_and_printing_project:2.0 cpe:/a:hp:linux_imaging_and_printing_project:2.7.10 cpe:/a:hp:linux_imaging_and_printing_project:3.9.2 cpe:/a:hp:linux_imaging_and_printing_project:3.9.4 cpe:/a:hp:linux_imaging_and_printing_project:3.9.4b cpe:/a:hp:linux_imaging_and_printing_project:3.9.6 cpe:/a:hp:linux_imaging_and_printing_project:3.9.8 cpe:/a:hp:linux_imaging_and_printing_project:3.9.10 cpe:/a:hp:linux_imaging_and_printing_project:3.9.12 cpe:/a:hp:linux_imaging_and_printing_project:3.10.2 cpe:/a:hp:linux_imaging_and_printing_project:3.10.5 cpe:/a:hp:linux_imaging_and_printing_project:3.10.6 cpe:/a:hp:linux_imaging_and_printing_project:3.10.9 cpe:/a:hp:linux_imaging_and_printing_project:3.11.1 cpe:/a:hp:linux_imaging_and_printing_project:3.11.3 cpe:/a:hp:linux_imaging_and_printing_project:3.11.3a cpe:/a:hp:linux_imaging_and_printing_project:3.11.5 cpe:/a:hp:linux_imaging_and_printing_project:3.11.7 cpe:/a:hp:linux_imaging_and_printing_project:3.11.10 cpe:/a:hp:linux_imaging_and_printing_project:3.12.4 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0200

2013-03-06T15:55:01.293-05:00

2019-04-22T13:48:00.643-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm MISC http://hplipopensource.com/hplip-web/release_notes.html DEBIAN DSA-2829 MANDRIVA MDVSA-2013:088 UBUNTU USN-1981-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=902163 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072 HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.

CVE-2013-0201

2014-03-18T13:02:50.310-04:00

2017-08-28T21:33:00.137-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-001 XF owncloud-mime-token-xss(81475) CONFIRM https://github.com/owncloud/core/commit/4e2b834 CONFIRM https://github.com/owncloud/core/commit/b8e0309 Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.

cpe:/a:owncloud:owncloud:4.5.0 cpe:/a:owncloud:owncloud:4.5.1 cpe:/a:owncloud:owncloud:4.5.2 cpe:/a:owncloud:owncloud:4.5.3 cpe:/a:owncloud:owncloud:4.5.4 cpe:/a:owncloud:owncloud:4.5.5

CVE-2013-0204

2014-06-04T10:55:03.653-04:00

2014-06-04T14:01:15.550-04:00

4.6

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-06-04T14:01:15.003-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-002/ settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.

cpe:/a:restful_web_services_project:restws:7.x-1.0 cpe:/a:restful_web_services_project:restws:7.x-1.0:beta1 cpe:/a:restful_web_services_project:restws:7.x-1.0:beta2 cpe:/a:restful_web_services_project:restws:7.x-1.x:dev cpe:/a:restful_web_services_project:restws:7.x-2.0:alpha1 cpe:/a:restful_web_services_project:restws:7.x-2.0:alpha2 cpe:/a:restful_web_services_project:restws:7.x-2.x:dev

CVE-2013-0205

2013-03-19T10:55:01.090-04:00

2013-03-21T00:00:00.000-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-21T04:16:00.000-04:00

MLIST [oss-security] 20130121 Re: CVE request for Drupal contributed modules CONFIRM https://drupal.org/node/1890212 CONFIRM https://drupal.org/node/1890216 MISC https://drupal.org/node/1890222 Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.

cpe:/a:guy_bedford:live_css:6.x-2.0 cpe:/a:guy_bedford:live_css:7.x-2.0 cpe:/a:guy_bedford:live_css:7.x-2.0-beta1 cpe:/a:guy_bedford:live_css:7.x-2.1 cpe:/a:guy_bedford:live_css:7.x-2.2 cpe:/a:guy_bedford:live_css:7.x-2.3 cpe:/a:guy_bedford:live_css:7.x-2.4 cpe:/a:guy_bedford:live_css:7.x-2.5 cpe:/a:guy_bedford:live_css:7.x-2.6 cpe:/a:guy_bedford:live_css:7.x-2.x-dev

CVE-2013-0206

2013-03-19T10:55:02.620-04:00

2013-03-21T05:26:43.427-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2013-03-21T05:10:00.000-04:00

CONFIRM http://drupal.org/node/1883976 CONFIRM http://drupal.org/node/1883978 CONFIRM http://drupalcode.org/project/live_css.git/commitdiff/cb7005f CONFIRM http://drupalcode.org/project/live_css.git/commitdiff/ef323c8 MLIST [oss-security] 20130121 Re: CVE request for Drupal contributed modules MISC https://drupal.org/node/1890318 Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

cpe:/a:leighton_whiting:mark_complete

CVE-2013-0207

2013-03-19T10:55:02.637-04:00

2013-03-21T10:21:46.953-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-21T10:09:00.000-04:00

CONFIRM http://drupalcode.org/project/mark_complete.git/commitdiff/a18c7b2 MLIST [oss-security] 20130121 Re: CVE request for Drupal contributed modules MISC https://drupal.org/node/1890538 CONFIRM https://drupal.org/node/1890566 Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

cpe:/a:openstack:essex:- cpe:/a:openstack:folsom:- cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0208

2013-02-13T11:55:01.617-05:00

2017-08-28T21:33:00.277-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0208 MLIST [oss-security] 20130129 [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208) BID 57613 UBUNTU USN-1709-1 CONFIRM https://bugs.launchpad.net/nova/+bug/1069904 MISC https://bugzilla.redhat.com/show_bug.cgi?id=902629 XF nova-volume-security-bypass(81697) CONFIRM https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b CONFIRM https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.

cpe:/a:sixapart:movable_type:4.21 cpe:/a:sixapart:movable_type:4.22 cpe:/a:sixapart:movable_type:4.23 cpe:/a:sixapart:movable_type:4.24 cpe:/a:sixapart:movable_type:4.25 cpe:/a:sixapart:movable_type:4.26 cpe:/a:sixapart:movable_type:4.27 cpe:/a:sixapart:movable_type:4.28 cpe:/a:sixapart:movable_type:4.28::enterprise cpe:/a:sixapart:movable_type:4.28::open_source cpe:/a:sixapart:movable_type:4.29 cpe:/a:sixapart:movable_type:4.29::enterprise cpe:/a:sixapart:movable_type:4.29::open_source cpe:/a:sixapart:movable_type:4.31 cpe:/a:sixapart:movable_type:4.32 cpe:/a:sixapart:movable_type:4.33 cpe:/a:sixapart:movable_type:4.34 cpe:/a:sixapart:movable_type:4.35 cpe:/a:sixapart:movable_type:4.36 cpe:/a:sixapart:movable_type:4.36::open_source cpe:/a:sixapart:movable_type:4.37 cpe:/a:sixapart:movable_type:4.37::open_source cpe:/a:sixapart:movable_type:4.38 cpe:/a:sixapart:movable_type:4.38::open_source cpe:/a:sixapart:movable_type:4.261 cpe:/a:sixapart:movable_type:4.291 cpe:/a:sixapart:movable_type:4.291::enterprise cpe:/a:sixapart:movable_type:4.291::open_source cpe:/a:sixapart:movable_type:4.292 cpe:/a:sixapart:movable_type:4.292::enterprise cpe:/a:sixapart:movable_type:4.292::open_source cpe:/a:sixapart:movable_type:4.361 cpe:/a:sixapart:movable_type:4.361::open_source

CVE-2013-0209

2013-01-22T20:55:01.150-05:00

2013-01-29T00:00:00.000-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-01-23T10:47:00.000-05:00

MLIST [oss-security] 20130121 Re: CVE request for Movable Type CONFIRM http://www.movabletype.org/2013/01/movable_type_438_patch.html MISC http://www.sec-1.com/blog/?p=402 MISC http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

cpe:/a:theforeman:foreman:0.1 cpe:/a:theforeman:foreman:0.2 cpe:/a:theforeman:foreman:0.3 cpe:/a:theforeman:foreman:0.4 cpe:/a:theforeman:foreman:0.4.1 cpe:/a:theforeman:foreman:1.0

CVE-2013-0210

2014-05-08T10:29:07.597-04:00

2014-05-08T11:29:48.033-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-05-08T11:24:12.917-04:00

CONFIRM http://theforeman.org/security.html The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.

cpe:/a:libarchive:libarchive:3.1.2::~~~x64~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.10 cpe:/o:fedoraproject:fedora:17 cpe:/o:fedoraproject:fedora:18 cpe:/o:freebsd:freebsd:9.3 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2

CVE-2013-0211

2013-09-30T18:55:04.557-04:00

2018-10-30T12:27:35.843-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2013-4592 FEDORA FEDORA-2013-4576 FEDORA FEDORA-2013-4537 FEDORA FEDORA-2013-4522 SUSE openSUSE-SU-2015:0568 MANDRIVA MDVSA-2013:147 BID 58926 SECTRACK 1035995 UBUNTU USN-2549-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=902998 CONFIRM https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4 FREEBSD FreeBSD-SA-16:23 Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.

cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2012.1 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2012.2 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2012.2.1 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2012.2.2 cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0212

2013-02-24T16:55:01.143-05:00

2015-02-09T14:23:27.950-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2015-02-09T13:50:39.923-05:00

REDHAT RHSA-2013:0209 UBUNTU USN-1710-1 MLIST [oss-security] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) CONFIRM https://bugs.launchpad.net/glance/+bug/1098962 MISC https://bugzilla.redhat.com/show_bug.cgi?id=902964 CONFIRM https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 CONFIRM https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 CONFIRM https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89 CONFIRM https://launchpad.net/glance/+milestone/2012.2.3 MLIST [openstack] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

cpe:/a:samba:samba:3.0.0 cpe:/a:samba:samba:3.0.1 cpe:/a:samba:samba:3.0.2 cpe:/a:samba:samba:3.0.2:a cpe:/a:samba:samba:3.0.2a cpe:/a:samba:samba:3.0.3 cpe:/a:samba:samba:3.0.4 cpe:/a:samba:samba:3.0.4:rc1 cpe:/a:samba:samba:3.0.5 cpe:/a:samba:samba:3.0.6 cpe:/a:samba:samba:3.0.7 cpe:/a:samba:samba:3.0.8 cpe:/a:samba:samba:3.0.9 cpe:/a:samba:samba:3.0.10 cpe:/a:samba:samba:3.0.11 cpe:/a:samba:samba:3.0.12 cpe:/a:samba:samba:3.0.13 cpe:/a:samba:samba:3.0.14 cpe:/a:samba:samba:3.0.14:a cpe:/a:samba:samba:3.0.14a cpe:/a:samba:samba:3.0.15 cpe:/a:samba:samba:3.0.16 cpe:/a:samba:samba:3.0.17 cpe:/a:samba:samba:3.0.18 cpe:/a:samba:samba:3.0.19 cpe:/a:samba:samba:3.0.20 cpe:/a:samba:samba:3.0.20:a cpe:/a:samba:samba:3.0.20:b cpe:/a:samba:samba:3.0.20a cpe:/a:samba:samba:3.0.20b cpe:/a:samba:samba:3.0.21 cpe:/a:samba:samba:3.0.21:a cpe:/a:samba:samba:3.0.21:b cpe:/a:samba:samba:3.0.21:c cpe:/a:samba:samba:3.0.21a cpe:/a:samba:samba:3.0.21b cpe:/a:samba:samba:3.0.21c cpe:/a:samba:samba:3.0.22 cpe:/a:samba:samba:3.0.23 cpe:/a:samba:samba:3.0.23:a cpe:/a:samba:samba:3.0.23:b cpe:/a:samba:samba:3.0.23:c cpe:/a:samba:samba:3.0.23:d cpe:/a:samba:samba:3.0.23a cpe:/a:samba:samba:3.0.23b cpe:/a:samba:samba:3.0.23c cpe:/a:samba:samba:3.0.23d cpe:/a:samba:samba:3.0.24 cpe:/a:samba:samba:3.0.25 cpe:/a:samba:samba:3.0.25:a cpe:/a:samba:samba:3.0.25:b cpe:/a:samba:samba:3.0.25:c cpe:/a:samba:samba:3.0.25:pre1 cpe:/a:samba:samba:3.0.25:pre2 cpe:/a:samba:samba:3.0.25:rc1 cpe:/a:samba:samba:3.0.25:rc2 cpe:/a:samba:samba:3.0.25:rc3 cpe:/a:samba:samba:3.0.25a cpe:/a:samba:samba:3.0.25b cpe:/a:samba:samba:3.0.25c cpe:/a:samba:samba:3.0.26 cpe:/a:samba:samba:3.0.26:a cpe:/a:samba:samba:3.0.26a cpe:/a:samba:samba:3.0.27 cpe:/a:samba:samba:3.0.27:a cpe:/a:samba:samba:3.0.28 cpe:/a:samba:samba:3.0.28:a cpe:/a:samba:samba:3.0.29 cpe:/a:samba:samba:3.0.30 cpe:/a:samba:samba:3.0.31 cpe:/a:samba:samba:3.0.32 cpe:/a:samba:samba:3.0.33 cpe:/a:samba:samba:3.0.34 cpe:/a:samba:samba:3.0.35 cpe:/a:samba:samba:3.0.36 cpe:/a:samba:samba:3.0.37 cpe:/a:samba:samba:3.1.0 cpe:/a:samba:samba:3.2.0 cpe:/a:samba:samba:3.2.1 cpe:/a:samba:samba:3.2.2 cpe:/a:samba:samba:3.2.3 cpe:/a:samba:samba:3.2.4 cpe:/a:samba:samba:3.2.5 cpe:/a:samba:samba:3.2.6 cpe:/a:samba:samba:3.2.7 cpe:/a:samba:samba:3.2.8 cpe:/a:samba:samba:3.2.9 cpe:/a:samba:samba:3.2.10 cpe:/a:samba:samba:3.2.11 cpe:/a:samba:samba:3.2.12 cpe:/a:samba:samba:3.2.13 cpe:/a:samba:samba:3.2.14 cpe:/a:samba:samba:3.2.15 cpe:/a:samba:samba:3.3.0 cpe:/a:samba:samba:3.3.1 cpe:/a:samba:samba:3.3.2 cpe:/a:samba:samba:3.3.3 cpe:/a:samba:samba:3.3.4 cpe:/a:samba:samba:3.3.5 cpe:/a:samba:samba:3.3.6 cpe:/a:samba:samba:3.3.7 cpe:/a:samba:samba:3.3.8 cpe:/a:samba:samba:3.3.9 cpe:/a:samba:samba:3.3.10 cpe:/a:samba:samba:3.3.11 cpe:/a:samba:samba:3.3.12 cpe:/a:samba:samba:3.3.13 cpe:/a:samba:samba:3.3.14 cpe:/a:samba:samba:3.3.15 cpe:/a:samba:samba:3.3.16 cpe:/a:samba:samba:3.4.0 cpe:/a:samba:samba:3.4.1 cpe:/a:samba:samba:3.4.2 cpe:/a:samba:samba:3.4.3 cpe:/a:samba:samba:3.4.4 cpe:/a:samba:samba:3.4.5 cpe:/a:samba:samba:3.4.6 cpe:/a:samba:samba:3.4.7 cpe:/a:samba:samba:3.4.8 cpe:/a:samba:samba:3.4.9 cpe:/a:samba:samba:3.4.10 cpe:/a:samba:samba:3.4.11 cpe:/a:samba:samba:3.4.12 cpe:/a:samba:samba:3.4.13 cpe:/a:samba:samba:3.4.14 cpe:/a:samba:samba:3.4.15 cpe:/a:samba:samba:3.4.16 cpe:/a:samba:samba:3.4.17 cpe:/a:samba:samba:3.5.0 cpe:/a:samba:samba:3.5.1 cpe:/a:samba:samba:3.5.2 cpe:/a:samba:samba:3.5.3 cpe:/a:samba:samba:3.5.4 cpe:/a:samba:samba:3.5.5 cpe:/a:samba:samba:3.5.6 cpe:/a:samba:samba:3.5.7 cpe:/a:samba:samba:3.5.8 cpe:/a:samba:samba:3.5.9 cpe:/a:samba:samba:3.5.10 cpe:/a:samba:samba:3.5.11 cpe:/a:samba:samba:3.5.12 cpe:/a:samba:samba:3.5.13 cpe:/a:samba:samba:3.5.14 cpe:/a:samba:samba:3.5.15 cpe:/a:samba:samba:3.5.16 cpe:/a:samba:samba:3.5.17 cpe:/a:samba:samba:3.5.18 cpe:/a:samba:samba:3.5.19 cpe:/a:samba:samba:3.5.20 cpe:/a:samba:samba:3.6.0 cpe:/a:samba:samba:3.6.1 cpe:/a:samba:samba:3.6.2 cpe:/a:samba:samba:3.6.3 cpe:/a:samba:samba:3.6.4 cpe:/a:samba:samba:3.6.5 cpe:/a:samba:samba:3.6.6 cpe:/a:samba:samba:3.6.7 cpe:/a:samba:samba:3.6.8 cpe:/a:samba:samba:3.6.9 cpe:/a:samba:samba:3.6.10 cpe:/a:samba:samba:3.6.11 cpe:/a:samba:samba:4.0.0 cpe:/a:samba:samba:4.0.1

CVE-2013-0213

2013-02-02T15:55:03.100-05:00

2018-10-30T12:25:59.730-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2013:0326 SUSE SUSE-SU-2013:0519 SUSE openSUSE-SU-2013:0277 SUSE openSUSE-SU-2013:0281 REDHAT RHSA-2013:1310 REDHAT RHSA-2013:1542 REDHAT RHSA-2014:0305 DEBIAN DSA-2617 CONFIRM http://www.samba.org/samba/security/CVE-2013-0213 BID 57631 UBUNTU USN-2922-1 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.

CVE-2013-0214

2013-02-02T15:55:03.147-05:00

2018-10-30T12:25:59.730-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2013:0326 SUSE SUSE-SU-2013:0519 SUSE openSUSE-SU-2013:0277 SUSE openSUSE-SU-2013:0281 REDHAT RHSA-2013:1310 REDHAT RHSA-2013:1542 REDHAT RHSA-2014:0305 DEBIAN DSA-2617 CONFIRM http://www.samba.org/samba/security/CVE-2013-0214 BID 57631 UBUNTU USN-2922-1 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.

cpe:/o:xen:xen:4.1.0 cpe:/o:xen:xen:4.1.1 cpe:/o:xen:xen:4.1.2 cpe:/o:xen:xen:4.1.3 cpe:/o:xen:xen:4.1.4 cpe:/o:xen:xen:4.2.0 cpe:/o:xen:xen:4.2.1

CVE-2013-0215

2013-03-07T00:04:44.667-05:00

2013-10-10T23:48:28.620-04:00

4.3

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20130205 Xen Security Advisory 38 (CVE-2013-0215) - oxenstored incorrect handling of certain Xenbus ring states GENTOO GLSA-201309-24 CONFIRM http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=40f9c5e0a6d15b4ca1f6d4ed3a46f0871520eab5 CONFIRM http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=61401264eb00fae4ee4efc8e9a5067449283207b oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.

CVE-2013-0216

2013-02-17T23:41:50.323-05:00

2013-08-22T02:48:26.023-04:00

5.2

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=48856286b64e4b66ec62b94e504d0b29c1ade664 SUSE openSUSE-SU-2013:0395 SUSE SUSE-SU-2013:0674 SUSE openSUSE-SU-2013:0925 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8 MANDRIVA MDVSA-2013:176 MLIST [oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring. CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=910883 CONFIRM https://github.com/torvalds/linux/commit/48856286b64e4b66ec62b94e504d0b29c1ade664 The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.

CVE-2013-0217

2013-02-17T23:41:50.367-05:00

2013-08-22T02:48:26.110-04:00

5.2

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7d5145d8eb2b9791533ffe4dc003b129b9696c48 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8 MANDRIVA MDVSA-2013:176 MLIST [oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring. CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=910883 CONFIRM https://github.com/torvalds/linux/commit/7d5145d8eb2b9791533ffe4dc003b129b9696c48 Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.

cpe:/a:redhat:jboss_enterprise_application_platform:5.1.2 cpe:/a:redhat:jboss_enterprise_application_platform:5.2.0 cpe:/a:redhat:jboss_enterprise_web_platform:5.1.2 cpe:/a:redhat:jboss_enterprise_web_platform:5.2.0

CVE-2013-0218

2013-02-05T18:55:01.897-05:00

2017-08-28T21:33:00.340-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2013:0206 REDHAT RHSA-2013:0207 REDHAT RHSA-2013:0833 BID 57652 MISC https://bugzilla.redhat.com/show_bug.cgi?id=903073 XF jboss-eap-info-disc(81725) The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.

cpe:/a:fedoraproject:sssd:0.2.1 cpe:/a:fedoraproject:sssd:0.3.0 cpe:/a:fedoraproject:sssd:0.3.1 cpe:/a:fedoraproject:sssd:0.3.2 cpe:/a:fedoraproject:sssd:0.3.3 cpe:/a:fedoraproject:sssd:0.4.0 cpe:/a:fedoraproject:sssd:0.4.1 cpe:/a:fedoraproject:sssd:0.5.0 cpe:/a:fedoraproject:sssd:0.6.0 cpe:/a:fedoraproject:sssd:0.6.1 cpe:/a:fedoraproject:sssd:0.7.0 cpe:/a:fedoraproject:sssd:0.7.1 cpe:/a:fedoraproject:sssd:0.99.0 cpe:/a:fedoraproject:sssd:0.99.1 cpe:/a:fedoraproject:sssd:1.0.0 cpe:/a:fedoraproject:sssd:1.0.1 cpe:/a:fedoraproject:sssd:1.0.2 cpe:/a:fedoraproject:sssd:1.0.3 cpe:/a:fedoraproject:sssd:1.0.4 cpe:/a:fedoraproject:sssd:1.0.5 cpe:/a:fedoraproject:sssd:1.0.6 cpe:/a:fedoraproject:sssd:1.0.99 cpe:/a:fedoraproject:sssd:1.1.0 cpe:/a:fedoraproject:sssd:1.1.1 cpe:/a:fedoraproject:sssd:1.1.2 cpe:/a:fedoraproject:sssd:1.1.91 cpe:/a:fedoraproject:sssd:1.1.92 cpe:/a:fedoraproject:sssd:1.2.0 cpe:/a:fedoraproject:sssd:1.2.1 cpe:/a:fedoraproject:sssd:1.2.2 cpe:/a:fedoraproject:sssd:1.2.3 cpe:/a:fedoraproject:sssd:1.2.4 cpe:/a:fedoraproject:sssd:1.2.91 cpe:/a:fedoraproject:sssd:1.3.0 cpe:/a:fedoraproject:sssd:1.3.1 cpe:/a:fedoraproject:sssd:1.4.0 cpe:/a:fedoraproject:sssd:1.4.1 cpe:/a:fedoraproject:sssd:1.5.0 cpe:/a:fedoraproject:sssd:1.5.1 cpe:/a:fedoraproject:sssd:1.5.2 cpe:/a:fedoraproject:sssd:1.5.3 cpe:/a:fedoraproject:sssd:1.5.4 cpe:/a:fedoraproject:sssd:1.5.5 cpe:/a:fedoraproject:sssd:1.5.6 cpe:/a:fedoraproject:sssd:1.5.6.1 cpe:/a:fedoraproject:sssd:1.5.7 cpe:/a:fedoraproject:sssd:1.5.8 cpe:/a:fedoraproject:sssd:1.5.9 cpe:/a:fedoraproject:sssd:1.5.10 cpe:/a:fedoraproject:sssd:1.5.11 cpe:/a:fedoraproject:sssd:1.5.12 cpe:/a:fedoraproject:sssd:1.5.13 cpe:/a:fedoraproject:sssd:1.5.14 cpe:/a:fedoraproject:sssd:1.5.15 cpe:/a:fedoraproject:sssd:1.5.16 cpe:/a:fedoraproject:sssd:1.5.17 cpe:/a:fedoraproject:sssd:1.6.0 cpe:/a:fedoraproject:sssd:1.6.1 cpe:/a:fedoraproject:sssd:1.6.2 cpe:/a:fedoraproject:sssd:1.6.3 cpe:/a:fedoraproject:sssd:1.6.4 cpe:/a:fedoraproject:sssd:1.7.0 cpe:/a:fedoraproject:sssd:1.8.0 cpe:/a:fedoraproject:sssd:1.8.0:beta1 cpe:/a:fedoraproject:sssd:1.8.0:beta2 cpe:/a:fedoraproject:sssd:1.8.0:beta3 cpe:/a:fedoraproject:sssd:1.8.1 cpe:/a:fedoraproject:sssd:1.8.2 cpe:/a:fedoraproject:sssd:1.8.3 cpe:/a:fedoraproject:sssd:1.8.4 cpe:/a:fedoraproject:sssd:1.8.5 cpe:/a:fedoraproject:sssd:1.8.6 cpe:/a:fedoraproject:sssd:1.9.0 cpe:/a:fedoraproject:sssd:1.9.1 cpe:/a:fedoraproject:sssd:1.9.2 cpe:/a:fedoraproject:sssd:1.9.3 cpe:/o:redhat:enterprise_linux:5 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0219

2013-02-24T14:55:01.237-05:00

2019-04-22T13:48:00.643-04:00

3.7

LOCAL

HIGH

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37 FEDORA FEDORA-2013-1795 FEDORA FEDORA-2013-1826 REDHAT RHSA-2013:0508 REDHAT RHSA-2013:1319 BID 57539 MISC https://bugzilla.redhat.com/show_bug.cgi?id=884254 CONFIRM https://fedorahosted.org/sssd/ticket/1782 CONFIRM https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4 System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.

CVE-2013-0220

2013-02-24T14:55:01.300-05:00

2013-02-27T14:50:57.027-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-02-25T14:36:00.000-05:00

CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab FEDORA FEDORA-2013-1795 FEDORA FEDORA-2013-1826 REDHAT RHSA-2013:0508 BID 57539 MISC https://bugzilla.redhat.com/show_bug.cgi?id=884601 CONFIRM https://fedorahosted.org/sssd/ticket/1781 CONFIRM https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4 The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.

cpe:/a:gnu:coreutils cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0221

2013-11-23T13:55:04.157-05:00

2019-04-22T13:48:00.643-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-11-25T12:52:49.400-05:00

REDHAT RHSA-2013:1652 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=798538 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=903464 CONFIRM https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.

cpe:/a:gnu:coreutils cpe:/o:opensuse:opensuse:11.4 cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0222

2013-11-23T13:55:04.173-05:00

2019-04-22T13:48:00.643-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-11-25T08:03:15.000-05:00

REDHAT RHSA-2013:1652 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=796243 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=903465 CONFIRM https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.

cpe:/a:gnu:coreutils cpe:/o:opensuse:opensuse:11.4 cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0223

2013-11-23T13:55:04.187-05:00

2019-04-22T13:48:00.643-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-11-25T12:58:51.597-05:00

REDHAT RHSA-2013:1652 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=798541 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=903466 CONFIRM https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19 The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.

cpe:/a:video_project:video:7.x-2.0:alpha1 cpe:/a:video_project:video:7.x-2.0:alpha2 cpe:/a:video_project:video:7.x-2.0:alpha3 cpe:/a:video_project:video:7.x-2.0:alpha4 cpe:/a:video_project:video:7.x-2.0:alpha5 cpe:/a:video_project:video:7.x-2.0:alpha6 cpe:/a:video_project:video:7.x-2.1:alpha1 cpe:/a:video_project:video:7.x-2.1:alpha2 cpe:/a:video_project:video:7.x-2.1:alpha3 cpe:/a:video_project:video:7.x-2.2 cpe:/a:video_project:video:7.x-2.2:beta1 cpe:/a:video_project:video:7.x-2.2:beta2 cpe:/a:video_project:video:7.x-2.2:beta3 cpe:/a:video_project:video:7.x-2.2:beta4 cpe:/a:video_project:video:7.x-2.2:beta5 cpe:/a:video_project:video:7.x-2.3 cpe:/a:video_project:video:7.x-2.4 cpe:/a:video_project:video:7.x-2.5 cpe:/a:video_project:video:7.x-2.6 cpe:/a:video_project:video:7.x-2.7 cpe:/a:video_project:video:7.x-2.8 cpe:/a:video_project:video:7.x-2.x:dev

CVE-2013-0224

2013-03-19T10:55:02.657-04:00

2013-03-21T00:00:00.000-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-21T10:15:00.000-04:00

MLIST [oss-security] 20130124 Re: CVE request for Drupal contributed modules CONFIRM https://drupal.org/node/1895234 MISC https://drupal.org/node/1896714 The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.

cpe:/a:user_relationships_project:user_relationships:6.x-1.0 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta1 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta10 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta2 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta3 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta4 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta5 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta6 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta7 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta8 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:beta9 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc1 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc2 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc3 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc4 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc5 cpe:/a:user_relationships_project:user_relationships:6.x-1.0:rc6 cpe:/a:user_relationships_project:user_relationships:6.x-1.1 cpe:/a:user_relationships_project:user_relationships:6.x-1.2 cpe:/a:user_relationships_project:user_relationships:6.x-1.3 cpe:/a:user_relationships_project:user_relationships:6.x-1.x:dev cpe:/a:user_relationships_project:user_relationships:7.x-1.0:alpha1 cpe:/a:user_relationships_project:user_relationships:7.x-1.0:alpha2 cpe:/a:user_relationships_project:user_relationships:7.x-1.0:alpha3 cpe:/a:user_relationships_project:user_relationships:7.x-1.0:alpha4 cpe:/a:user_relationships_project:user_relationships:7.x-1.x:dev

CVE-2013-0225

2013-03-19T10:55:02.673-04:00

2013-03-21T00:00:00.000-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-21T10:28:00.000-04:00

CONFIRM http://drupalcode.org/project/user_relationships.git/commitdiff/17e94b9 CONFIRM http://drupalcode.org/project/user_relationships.git/commitdiff/b9a4739 MLIST [oss-security] 20130124 Re: CVE request for Drupal contributed modules CONFIRM https://drupal.org/node/1896272 CONFIRM https://drupal.org/node/1896276 MISC https://drupal.org/node/1896720 Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name.

cpe:/a:zugec_ivan:keyboard_shortcut_utility:7.x-1.0

CVE-2013-0226

2013-03-19T10:55:02.690-04:00

2013-03-21T10:45:15.390-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2013-03-21T10:41:00.000-04:00

MLIST [oss-security] 20130124 Re: CVE request for Drupal contributed modules MISC https://drupal.org/node/1896752 The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors.

cpe:/a:mathijs_koenraadt:search_api_sorts:7.x-1.0 cpe:/a:mathijs_koenraadt:search_api_sorts:7.x-1.1 cpe:/a:mathijs_koenraadt:search_api_sorts:7.x-1.2 cpe:/a:mathijs_koenraadt:search_api_sorts:7.x-1.3 cpe:/a:mathijs_koenraadt:search_api_sorts:7.x-1.x:dev

CVE-2013-0227

2013-03-19T10:55:02.710-04:00

2013-03-21T00:00:00.000-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-21T10:39:00.000-04:00

CONFIRM http://drupalcode.org/project/search_api_sorts.git/commitdiff/f6cbf47 MLIST [oss-security] 20130124 Re: CVE request for Drupal contributed modules CONFIRM https://drupal.org/node/1896756 MISC https://drupal.org/node/1896782 Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.

CVE-2013-0228

2013-03-01T07:37:54.100-05:00

2013-08-22T02:48:26.937-04:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9 MANDRIVA MDVSA-2013:176 MLIST [oss-security] 20130213 Xen Security Advisory 42 (CVE-2013-0228) - Linux kernel hits general protection if %ds is corrupt for 32-bit PVOPS. UBUNTU USN-1795-1 UBUNTU USN-1796-1 UBUNTU USN-1797-1 UBUNTU USN-1805-1 UBUNTU USN-1808-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=906309 CONFIRM https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.

cpe:/a:miniupnp_project:miniupnpd:1.0 cpe:/a:miniupnp_project:miniupnpd:1.1 cpe:/a:miniupnp_project:miniupnpd:1.2 cpe:/a:miniupnp_project:miniupnpd:1.3

CVE-2013-0229

2013-01-31T16:55:01.490-05:00

2015-10-08T10:34:43.787-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2015-10-08T10:17:14.793-04:00

MISC https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play MISC https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf MISC https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.

cpe:/a:miniupnp_project:miniupnpd:1.0

CVE-2013-0230

2013-01-31T16:55:01.520-05:00

2016-12-07T22:02:55.567-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 57608 MISC https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play MISC https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf MISC https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb EXPLOIT-DB 36839 Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.

cpe:/o:linux:linux_kernel:2.6.18 cpe:/o:linux:linux_kernel:3.8 cpe:/o:xen:xen:3.0.2 cpe:/o:xen:xen:3.0.3 cpe:/o:xen:xen:3.0.4 cpe:/o:xen:xen:3.1.3 cpe:/o:xen:xen:3.1.4 cpe:/o:xen:xen:3.2.0 cpe:/o:xen:xen:3.2.1 cpe:/o:xen:xen:3.2.2 cpe:/o:xen:xen:3.2.3

CVE-2013-0231

2013-02-12T20:55:03.497-05:00

2017-08-28T21:33:00.417-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2013:0395 SUSE SUSE-SU-2013:0674 SUSE openSUSE-SU-2013:0925 DEBIAN DSA-2632 MLIST [oss-security] 20130205 Xen Security Advisory 43 (CVE-2013-0231) - Linux pciback DoS via not rate limited log messages. BID 57740 XF xen-pcibackenablemsi-dos(81923) The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information.

cpe:/a:zoneminder:zoneminder:1.24.0 cpe:/a:zoneminder:zoneminder:1.24.1 cpe:/a:zoneminder:zoneminder:1.24.2 cpe:/a:zoneminder:zoneminder:1.24.3 cpe:/a:zoneminder:zoneminder:1.24.4 cpe:/a:zoneminder:zoneminder:1.25.0

CVE-2013-0232

2013-03-20T11:55:00.910-04:00

2013-08-29T02:46:18.417-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 MISC http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/ DEBIAN DSA-2640 EXPLOIT-DB 24310 MLIST [oss-security] 20130128 Re: CVE Request: zoneminder: arbitrary command execution vulnerability MISC http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771 includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.

cpe:/a:plataformatec:devise:1.5.0 cpe:/a:plataformatec:devise:1.5.1 cpe:/a:plataformatec:devise:1.5.2 cpe:/a:plataformatec:devise:1.5.3 cpe:/a:plataformatec:devise:2.0.0 cpe:/a:plataformatec:devise:2.0.1 cpe:/a:plataformatec:devise:2.0.2 cpe:/a:plataformatec:devise:2.0.3 cpe:/a:plataformatec:devise:2.0.4 cpe:/a:plataformatec:devise:2.1.0 cpe:/a:plataformatec:devise:2.1.1 cpe:/a:plataformatec:devise:2.1.2 cpe:/a:plataformatec:devise:2.2.0 cpe:/a:plataformatec:devise:2.2.1 cpe:/a:plataformatec:devise:2.2.2 cpe:/o:opensuse:opensuse:12.2

CVE-2013-0233

2013-04-25T19:55:01.460-04:00

2018-10-30T12:27:33.937-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-04-26T10:12:00.000-04:00

CONFIRM http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/ SUSE openSUSE-SU-2013:0374 MISC http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset MLIST [oss-security] 20130128 Re: CVE request for 'devise' ruby gem MISC http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html BID 57577 MISC https://github.com/Snorby/snorby/issues/261 Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

cpe:/a:elgg:elgg:1.7.0 cpe:/a:elgg:elgg:1.7.1 cpe:/a:elgg:elgg:1.7.2 cpe:/a:elgg:elgg:1.7.3 cpe:/a:elgg:elgg:1.7.4 cpe:/a:elgg:elgg:1.7.5 cpe:/a:elgg:elgg:1.7.6 cpe:/a:elgg:elgg:1.7.7 cpe:/a:elgg:elgg:1.7.8 cpe:/a:elgg:elgg:1.7.9 cpe:/a:elgg:elgg:1.7.10 cpe:/a:elgg:elgg:1.7.11 cpe:/a:elgg:elgg:1.7.12 cpe:/a:elgg:elgg:1.7.13 cpe:/a:elgg:elgg:1.7.14 cpe:/a:elgg:elgg:1.7.15 cpe:/a:elgg:elgg:1.7.16 cpe:/a:elgg:elgg:1.7.18 cpe:/a:elgg:elgg:1.8.0.1 cpe:/a:elgg:elgg:1.8.1 cpe:/a:elgg:elgg:1.8.3 cpe:/a:elgg:elgg:1.8.4 cpe:/a:elgg:elgg:1.8.5 cpe:/a:elgg:elgg:1.8.6 cpe:/a:elgg:elgg:1.8.7 cpe:/a:elgg:elgg:1.8.8 cpe:/a:elgg:elgg:1.8.9 cpe:/a:elgg:elgg:1.8.10 cpe:/a:elgg:elgg:1.8.11 cpe:/a:elgg:elgg:1.8.12

CVE-2013-0234

2014-02-02T15:55:14.133-05:00

2014-02-21T13:08:15.593-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-02-02T13:29:19.000-05:00

CONFIRM http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717 MISC http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html FULLDISC 20130129 XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") MLIST [oss-security] 20130128 Re: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") BID 57569 CONFIRM https://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11 CONFIRM https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21 Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.

cpe:/a:wordpress:wordpress:0.71 cpe:/a:wordpress:wordpress:1.0 cpe:/a:wordpress:wordpress:1.0.1 cpe:/a:wordpress:wordpress:1.0.2 cpe:/a:wordpress:wordpress:1.1.1 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.2.1 cpe:/a:wordpress:wordpress:1.2.2 cpe:/a:wordpress:wordpress:1.2.3 cpe:/a:wordpress:wordpress:1.2.4 cpe:/a:wordpress:wordpress:1.2.5 cpe:/a:wordpress:wordpress:1.2.5:a cpe:/a:wordpress:wordpress:1.3 cpe:/a:wordpress:wordpress:1.3.2 cpe:/a:wordpress:wordpress:1.3.3 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:1.5.2 cpe:/a:wordpress:wordpress:1.6.2 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 cpe:/a:wordpress:wordpress:2.0.2 cpe:/a:wordpress:wordpress:2.0.4 cpe:/a:wordpress:wordpress:2.0.5 cpe:/a:wordpress:wordpress:2.0.6 cpe:/a:wordpress:wordpress:2.0.7 cpe:/a:wordpress:wordpress:2.0.8 cpe:/a:wordpress:wordpress:2.0.9 cpe:/a:wordpress:wordpress:2.0.10 cpe:/a:wordpress:wordpress:2.0.11 cpe:/a:wordpress:wordpress:2.1 cpe:/a:wordpress:wordpress:2.1.1 cpe:/a:wordpress:wordpress:2.1.2 cpe:/a:wordpress:wordpress:2.1.3 cpe:/a:wordpress:wordpress:2.2 cpe:/a:wordpress:wordpress:2.2.1 cpe:/a:wordpress:wordpress:2.2.2 cpe:/a:wordpress:wordpress:2.2.3 cpe:/a:wordpress:wordpress:2.3 cpe:/a:wordpress:wordpress:2.3.1 cpe:/a:wordpress:wordpress:2.3.2 cpe:/a:wordpress:wordpress:2.3.3 cpe:/a:wordpress:wordpress:2.5 cpe:/a:wordpress:wordpress:2.5.1 cpe:/a:wordpress:wordpress:2.6 cpe:/a:wordpress:wordpress:2.6.1 cpe:/a:wordpress:wordpress:2.6.2 cpe:/a:wordpress:wordpress:2.6.3 cpe:/a:wordpress:wordpress:2.6.5 cpe:/a:wordpress:wordpress:2.7 cpe:/a:wordpress:wordpress:2.7.1 cpe:/a:wordpress:wordpress:2.8 cpe:/a:wordpress:wordpress:2.8.1 cpe:/a:wordpress:wordpress:2.8.2 cpe:/a:wordpress:wordpress:2.8.3 cpe:/a:wordpress:wordpress:2.8.4 cpe:/a:wordpress:wordpress:2.8.4:a cpe:/a:wordpress:wordpress:2.8.5 cpe:/a:wordpress:wordpress:2.8.5.1 cpe:/a:wordpress:wordpress:2.8.5.2 cpe:/a:wordpress:wordpress:2.8.6 cpe:/a:wordpress:wordpress:2.9 cpe:/a:wordpress:wordpress:2.9.1 cpe:/a:wordpress:wordpress:2.9.1.1 cpe:/a:wordpress:wordpress:2.9.2 cpe:/a:wordpress:wordpress:3.3 cpe:/a:wordpress:wordpress:3.3.1 cpe:/a:wordpress:wordpress:3.3.2 cpe:/a:wordpress:wordpress:3.3.3 cpe:/a:wordpress:wordpress:3.4.0 cpe:/a:wordpress:wordpress:3.4.1 cpe:/a:wordpress:wordpress:3.4.2 cpe:/a:wordpress:wordpress:3.5.0

CVE-2013-0235

2013-07-08T16:55:00.883-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-07-08T21:00:00.000-04:00

CONFIRM http://codex.wordpress.org/Version_3.5.1 CONFIRM http://core.trac.wordpress.org/changeset/23330 CONFIRM http://wordpress.org/news/2013/01/wordpress-3-5-1/ MISC http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/ CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=904120 The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

CVE-2013-0236

2013-07-08T16:55:00.960-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-07-08T21:06:00.000-04:00

CONFIRM http://codex.wordpress.org/Version_3.5.1 CONFIRM http://core.trac.wordpress.org/changeset/23317 CONFIRM http://core.trac.wordpress.org/changeset/23322 CONFIRM http://wordpress.org/news/2013/01/wordpress-3-5-1/ CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=904121 Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.

cpe:/a:moxiecode:plupload:1.4.0 cpe:/a:moxiecode:plupload:1.4.1 cpe:/a:moxiecode:plupload:1.4.2 cpe:/a:moxiecode:plupload:1.4.3 cpe:/a:moxiecode:plupload:1.5.0 cpe:/a:moxiecode:plupload:1.5.0:beta cpe:/a:moxiecode:plupload:1.5.1 cpe:/a:moxiecode:plupload:1.5.2 cpe:/a:moxiecode:plupload:1.5.3 cpe:/a:moxiecode:plupload:1.5.4 cpe:/a:wordpress:wordpress:0.71 cpe:/a:wordpress:wordpress:1.0 cpe:/a:wordpress:wordpress:1.0.1 cpe:/a:wordpress:wordpress:1.0.2 cpe:/a:wordpress:wordpress:1.1.1 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.2.1 cpe:/a:wordpress:wordpress:1.2.2 cpe:/a:wordpress:wordpress:1.2.3 cpe:/a:wordpress:wordpress:1.2.4 cpe:/a:wordpress:wordpress:1.2.5 cpe:/a:wordpress:wordpress:1.2.5:a cpe:/a:wordpress:wordpress:1.3 cpe:/a:wordpress:wordpress:1.3.2 cpe:/a:wordpress:wordpress:1.3.3 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:1.5.2 cpe:/a:wordpress:wordpress:1.6.2 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 cpe:/a:wordpress:wordpress:2.0.2 cpe:/a:wordpress:wordpress:2.0.4 cpe:/a:wordpress:wordpress:2.0.5 cpe:/a:wordpress:wordpress:2.0.6 cpe:/a:wordpress:wordpress:2.0.7 cpe:/a:wordpress:wordpress:2.0.8 cpe:/a:wordpress:wordpress:2.0.9 cpe:/a:wordpress:wordpress:2.0.10 cpe:/a:wordpress:wordpress:2.0.11 cpe:/a:wordpress:wordpress:2.1 cpe:/a:wordpress:wordpress:2.1.1 cpe:/a:wordpress:wordpress:2.1.2 cpe:/a:wordpress:wordpress:2.1.3 cpe:/a:wordpress:wordpress:2.2 cpe:/a:wordpress:wordpress:2.2.1 cpe:/a:wordpress:wordpress:2.2.2 cpe:/a:wordpress:wordpress:2.2.3 cpe:/a:wordpress:wordpress:2.3 cpe:/a:wordpress:wordpress:2.3.1 cpe:/a:wordpress:wordpress:2.3.2 cpe:/a:wordpress:wordpress:2.3.3 cpe:/a:wordpress:wordpress:2.5 cpe:/a:wordpress:wordpress:2.5.1 cpe:/a:wordpress:wordpress:2.6 cpe:/a:wordpress:wordpress:2.6.1 cpe:/a:wordpress:wordpress:2.6.2 cpe:/a:wordpress:wordpress:2.6.3 cpe:/a:wordpress:wordpress:2.6.5 cpe:/a:wordpress:wordpress:2.7 cpe:/a:wordpress:wordpress:2.7.1 cpe:/a:wordpress:wordpress:2.8 cpe:/a:wordpress:wordpress:2.8.1 cpe:/a:wordpress:wordpress:2.8.2 cpe:/a:wordpress:wordpress:2.8.3 cpe:/a:wordpress:wordpress:2.8.4 cpe:/a:wordpress:wordpress:2.8.4:a cpe:/a:wordpress:wordpress:2.8.5 cpe:/a:wordpress:wordpress:2.8.5.1 cpe:/a:wordpress:wordpress:2.8.5.2 cpe:/a:wordpress:wordpress:2.8.6 cpe:/a:wordpress:wordpress:2.9 cpe:/a:wordpress:wordpress:2.9.1 cpe:/a:wordpress:wordpress:2.9.1.1 cpe:/a:wordpress:wordpress:2.9.2 cpe:/a:wordpress:wordpress:3.3 cpe:/a:wordpress:wordpress:3.3.1 cpe:/a:wordpress:wordpress:3.3.2 cpe:/a:wordpress:wordpress:3.3.3 cpe:/a:wordpress:wordpress:3.4.0 cpe:/a:wordpress:wordpress:3.4.1 cpe:/a:wordpress:wordpress:3.4.2 cpe:/a:wordpress:wordpress:3.5.0 cpe:/o:fedoraproject:fedora:16 cpe:/o:fedoraproject:fedora:17 cpe:/o:fedoraproject:fedora:18

CVE-2013-0237

2013-07-08T16:55:00.993-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-07-08T21:09:00.000-04:00

CONFIRM http://codex.wordpress.org/Version_3.5.1 CONFIRM http://wordpress.org/news/2013/01/wordpress-3-5-1/ CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=904122 CONFIRM https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5 Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

cpe:/a:ircd-hybrid:ircd-hybrid:7.2.0 cpe:/a:ircd-hybrid:ircd-hybrid:7.2.1 cpe:/a:ircd-hybrid:ircd-hybrid:7.2.2 cpe:/a:ircd-hybrid:ircd-hybrid:7.2.3 cpe:/a:ircd-hybrid:ircd-hybrid:7.3.0 cpe:/a:ircd-hybrid:ircd-hybrid:7.3.0:rc1 cpe:/a:ircd-hybrid:ircd-hybrid:7.3.1 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.0 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.0:beta1 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.0:beta2 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.0:beta3 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.0:rc1 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.1 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.2 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.3 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.4 cpe:/a:ircd-hybrid:ircd-hybrid:8.0.5

CVE-2013-0238

2013-02-12T20:55:04.090-05:00

2017-08-28T21:33:00.480-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699267 CONFIRM http://svn.ircd-hybrid.org:8000/viewcvs.cgi/ircd-hybrid/trunk/src/hostmask.c?r1=1786&r2=1785&pathrev=1786 DEBIAN DSA-2618 EXPLOIT-DB 24951 MANDRIVA MDVSA-2013:093 MLIST [oss-security] 20130129 ircd-hybrid: Denial of service vulnerability in hostmask.c:try_parse_v4_netmask() BID 57610 XF ircdhybrid-tryparsev4netmask-dos(81695) CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0055 The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.

cpe:/a:apache:cxf:2.4.0 cpe:/a:apache:cxf:2.4.1 cpe:/a:apache:cxf:2.4.2 cpe:/a:apache:cxf:2.4.3 cpe:/a:apache:cxf:2.4.4 cpe:/a:apache:cxf:2.4.5 cpe:/a:apache:cxf:2.4.6 cpe:/a:apache:cxf:2.4.7 cpe:/a:apache:cxf:2.5.0 cpe:/a:apache:cxf:2.5.1 cpe:/a:apache:cxf:2.5.2 cpe:/a:apache:cxf:2.5.3 cpe:/a:apache:cxf:2.5.4 cpe:/a:apache:cxf:2.5.5 cpe:/a:apache:cxf:2.5.6 cpe:/a:apache:cxf:2.5.7 cpe:/a:apache:cxf:2.5.8 cpe:/a:apache:cxf:2.6.0 cpe:/a:apache:cxf:2.6.1 cpe:/a:apache:cxf:2.6.2 cpe:/a:apache:cxf:2.6.3 cpe:/a:apache:cxf:2.6.4 cpe:/a:apache:cxf:2.6.5 cpe:/a:apache:cxf:2.7.0 cpe:/a:apache:cxf:2.7.1 cpe:/a:apache:cxf:2.7.2

CVE-2013-0239

2013-03-12T19:55:01.690-04:00

2017-08-28T21:33:00.543-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://cxf.apache.org/cve-2013-0239.html MISC http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html REDHAT RHSA-2013:0749 FULLDISC 20130208 New security advisories for Apache CXF CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1438424 BID 57876 XF apachecxf-username-tokens-sec-bypass(81981) Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

cpe:/a:gnome:gnome_online_accounts:3.4.0 cpe:/a:gnome:gnome_online_accounts:3.4.1 cpe:/a:gnome:gnome_online_accounts:3.6.0 cpe:/a:gnome:gnome_online_accounts:3.6.1 cpe:/a:gnome:gnome_online_accounts:3.6.2 cpe:/a:gnome:gnome_online_accounts:3.7.1 cpe:/a:gnome:gnome_online_accounts:3.7.2 cpe:/a:gnome:gnome_online_accounts:3.7.3 cpe:/a:gnome:gnome_online_accounts:3.7.4 cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0240

2013-04-01T23:22:21.037-04:00

2013-04-02T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-02T09:57:00.000-04:00

SUSE openSUSE-SU-2013:0301 UBUNTU USN-1779-1 CONFIRM https://bugzilla.gnome.org/show_bug.cgi?id=693214 MISC https://bugzilla.redhat.com/show_bug.cgi?id=894352 CONFIRM https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1 CONFIRM https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f CONFIRM https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e MLIST [gnome-announce-list] 20130304 GNOME Online Accounts 3.6.3 released Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.

cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:qxl_graphics_driver_project:xf86-video-qxl:0.1.0 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_workstation:6.0

CVE-2013-0241

2013-02-12T20:55:04.137-05:00

2017-08-28T21:33:00.637-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0218 MANDRIVA MDVSA-2013:138 MLIST [oss-security] 20130130 CVE request -- qxl: synchronous io guest DoS MLIST [oss-security] 20130130 Re: CVE request -- qxl: synchronous io guest DoS UBUNTU USN-1714-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=906032 XF qxl-virtual-spice-dos(81704) CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0036 The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information.

cpe:/a:gnu:glibc:2.17

CVE-2013-0242

2013-02-08T15:55:01.483-05:00

2017-08-28T21:33:00.713-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0769 REDHAT RHSA-2013:1605 MISC http://sourceware.org/bugzilla/show_bug.cgi?id=15078 MLIST [libc-alpha] 20130129 [PATCH] Fix buffer overrun in regexp matcher MANDRIVA MDVSA-2013:163 MLIST [oss-security] 20130130 Re: CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters BID 57638 SECTRACK 1028063 UBUNTU USN-1991-1 CONFIRM http://www.vmware.com/security/advisories/VMSA-2014-0008.html XF glibc-extendbuffers-dos(81707) GENTOO GLSA-201503-04 Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.

cpe:/a:drupal:drupal:6.0 cpe:/a:drupal:drupal:6.0:beta1 cpe:/a:drupal:drupal:6.0:beta2 cpe:/a:drupal:drupal:6.0:beta3 cpe:/a:drupal:drupal:6.0:beta4 cpe:/a:drupal:drupal:6.0:dev cpe:/a:drupal:drupal:6.0:rc1 cpe:/a:drupal:drupal:6.0:rc2 cpe:/a:drupal:drupal:6.0:rc3 cpe:/a:drupal:drupal:6.0:rc4 cpe:/a:drupal:drupal:6.1 cpe:/a:drupal:drupal:6.2 cpe:/a:drupal:drupal:6.3 cpe:/a:drupal:drupal:6.4 cpe:/a:drupal:drupal:6.5 cpe:/a:drupal:drupal:6.6 cpe:/a:drupal:drupal:6.7 cpe:/a:drupal:drupal:6.8 cpe:/a:drupal:drupal:6.9 cpe:/a:drupal:drupal:6.10 cpe:/a:drupal:drupal:6.11 cpe:/a:drupal:drupal:6.12 cpe:/a:drupal:drupal:6.13 cpe:/a:drupal:drupal:6.14 cpe:/a:drupal:drupal:6.15 cpe:/a:drupal:drupal:6.16 cpe:/a:drupal:drupal:6.17 cpe:/a:drupal:drupal:6.18 cpe:/a:drupal:drupal:6.19 cpe:/a:drupal:drupal:6.20 cpe:/a:drupal:drupal:6.21 cpe:/a:drupal:drupal:6.22 cpe:/a:drupal:drupal:6.23 cpe:/a:drupal:drupal:6.24 cpe:/a:drupal:drupal:6.25 cpe:/a:drupal:drupal:6.26 cpe:/a:drupal:drupal:6.27 cpe:/a:drupal:drupal:7.0 cpe:/a:drupal:drupal:7.0:alpha1 cpe:/a:drupal:drupal:7.0:alpha2 cpe:/a:drupal:drupal:7.0:alpha3 cpe:/a:drupal:drupal:7.0:alpha4 cpe:/a:drupal:drupal:7.0:alpha5 cpe:/a:drupal:drupal:7.0:alpha6 cpe:/a:drupal:drupal:7.0:alpha7 cpe:/a:drupal:drupal:7.0:beta1 cpe:/a:drupal:drupal:7.0:beta2 cpe:/a:drupal:drupal:7.0:beta3 cpe:/a:drupal:drupal:7.0:dev cpe:/a:drupal:drupal:7.0:rc1 cpe:/a:drupal:drupal:7.0:rc2 cpe:/a:drupal:drupal:7.0:rc3 cpe:/a:drupal:drupal:7.0:rc4 cpe:/a:drupal:drupal:7.1 cpe:/a:drupal:drupal:7.2 cpe:/a:drupal:drupal:7.3 cpe:/a:drupal:drupal:7.4 cpe:/a:drupal:drupal:7.5 cpe:/a:drupal:drupal:7.6 cpe:/a:drupal:drupal:7.7 cpe:/a:drupal:drupal:7.8 cpe:/a:drupal:drupal:7.9 cpe:/a:drupal:drupal:7.10 cpe:/a:drupal:drupal:7.11 cpe:/a:drupal:drupal:7.12 cpe:/a:drupal:drupal:7.13 cpe:/a:drupal:drupal:7.14 cpe:/a:drupal:drupal:7.15 cpe:/a:drupal:drupal:7.16 cpe:/a:drupal:drupal:7.17 cpe:/a:drupal:drupal:7.18 cpe:/a:drupal:drupal:7.x-dev

CVE-2013-0244

2014-01-19T12:16:30.363-05:00

2014-03-08T00:02:41.260-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html FULLDISC 20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities MLIST [oss-security] 20130130 Re: CVE DEBIAN DSA-2776 CONFIRM https://drupal.org/SA-CORE-2013-001 Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.

CVE-2013-0245

2013-07-16T14:55:01.113-04:00

2017-08-28T21:33:00.793-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html FULLDISC 20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities MLIST [oss-security] 20130130 Re: CVE DEBIAN DSA-2776 CONFIRM https://drupal.org/SA-CORE-2013-001 XF drupal-book-title-security-bypass(81380) The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.

cpe:/a:drupal:drupal:7.0 cpe:/a:drupal:drupal:7.0:alpha1 cpe:/a:drupal:drupal:7.0:alpha2 cpe:/a:drupal:drupal:7.0:alpha3 cpe:/a:drupal:drupal:7.0:alpha4 cpe:/a:drupal:drupal:7.0:alpha5 cpe:/a:drupal:drupal:7.0:alpha6 cpe:/a:drupal:drupal:7.0:alpha7 cpe:/a:drupal:drupal:7.0:beta1 cpe:/a:drupal:drupal:7.0:beta2 cpe:/a:drupal:drupal:7.0:beta3 cpe:/a:drupal:drupal:7.0:dev cpe:/a:drupal:drupal:7.0:rc1 cpe:/a:drupal:drupal:7.0:rc2 cpe:/a:drupal:drupal:7.0:rc3 cpe:/a:drupal:drupal:7.0:rc4 cpe:/a:drupal:drupal:7.1 cpe:/a:drupal:drupal:7.2 cpe:/a:drupal:drupal:7.3 cpe:/a:drupal:drupal:7.4 cpe:/a:drupal:drupal:7.5 cpe:/a:drupal:drupal:7.6 cpe:/a:drupal:drupal:7.7 cpe:/a:drupal:drupal:7.8 cpe:/a:drupal:drupal:7.9 cpe:/a:drupal:drupal:7.10 cpe:/a:drupal:drupal:7.11 cpe:/a:drupal:drupal:7.12 cpe:/a:drupal:drupal:7.13 cpe:/a:drupal:drupal:7.14 cpe:/a:drupal:drupal:7.15 cpe:/a:drupal:drupal:7.16 cpe:/a:drupal:drupal:7.17 cpe:/a:drupal:drupal:7.18 cpe:/a:drupal:drupal:7.x-dev

CVE-2013-0246

2013-07-16T14:55:01.160-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-07-16T16:29:00.000-04:00

MISC http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html FULLDISC 20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities MLIST [oss-security] 20130130 Re: CVE CONFIRM https://drupal.org/SA-CORE-2013-001 The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.

cpe:/a:openstack:keystone:2012.1 cpe:/a:openstack:keystone:2012.1.1 cpe:/a:openstack:keystone:2012.1.2 cpe:/a:openstack:keystone:2012.1.3 cpe:/a:openstack:keystone:2012.2 cpe:/a:openstack:keystone:2012.2.1 cpe:/a:openstack:keystone:2012.2.2 cpe:/a:openstack:keystone:2012.2.3 cpe:/a:openstack:keystone:2013.1 cpe:/a:openstack:keystone:2013.1.1 cpe:/a:openstack:keystone:2013.1.2 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0247

2013-02-24T14:55:01.360-05:00

2018-11-15T12:56:36.910-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-02-25T14:40:00.000-05:00

FEDORA FEDORA-2013-2168 REDHAT RHSA-2013:0253 BID 57747 UBUNTU USN-1715-1 CONFIRM https://bugs.launchpad.net/keystone/+bug/1098307 MISC https://bugzilla.redhat.com/show_bug.cgi?id=906171 OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.

cpe:/a:apache:commons_fileupload:1.0 cpe:/a:apache:commons_fileupload:1.1 cpe:/a:apache:commons_fileupload:1.1.1 cpe:/a:apache:commons_fileupload:1.2 cpe:/a:apache:commons_fileupload:1.2.1 cpe:/a:apache:commons_fileupload:1.2.2

CVE-2013-0248

2013-03-15T16:55:10.553-04:00

2017-10-19T21:29:00.330-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples HP HPSBMU03409 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html BID 58326 The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

cpe:/a:haxx:curl:7.26.0 cpe:/a:haxx:curl:7.27.0 cpe:/a:haxx:curl:7.28.0 cpe:/a:haxx:curl:7.28.1 cpe:/a:haxx:libcurl:7.26.0 cpe:/a:haxx:libcurl:7.27.0 cpe:/a:haxx:libcurl:7.28.0 cpe:/a:haxx:libcurl:7.28.1 cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0249

2013-03-08T17:55:01.123-05:00

2016-12-07T22:02:56.643-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://blog.volema.com/curl-rce.html CONFIRM http://curl.haxx.se/docs/adv_20130206.html APPLE APPLE-SA-2013-10-22-3 FEDORA FEDORA-2013-2098 MISC http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/ MISC http://packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html MISC http://packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html EXPLOIT-DB 24487 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html BID 57842 SECTRACK 1028093 UBUNTU USN-1721-1 Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.

cpe:/a:corosync:corosync:2.0.0 cpe:/a:corosync:corosync:2.0.1 cpe:/a:corosync:corosync:2.0.2 cpe:/a:corosync:corosync:2.0.3 cpe:/a:corosync:corosync:2.1.0 cpe:/a:corosync:corosync:2.1.1 cpe:/a:corosync:corosync:2.2.0

CVE-2013-0250

2014-06-06T10:55:03.837-04:00

2014-06-09T09:34:15.860-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2014-06-09T09:34:15.640-04:00

MLIST [oss-security] 20130201 CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used MLIST [oss-security] 20130201 Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used MLIST [oss-security] 20130201 Re: Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used CONFIRM https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595 The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.

cpe:/a:debian:latd:1.25 cpe:/a:debian:latd:1.26 cpe:/a:debian:latd:1.27 cpe:/a:debian:latd:1.28 cpe:/a:debian:latd:1.29 cpe:/a:debian:latd:1.30

CVE-2013-0251

2013-03-19T10:55:02.730-04:00

2013-03-21T08:00:26.770-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-03-21T07:52:00.000-04:00

MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699625 MLIST [oss-security] 20130203 Re: CVE id request: latd MLIST [oss-security] 20130205 Re: CVE id request: latd Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.

cpe:/a:boost:boost:1.48.0 cpe:/a:boost:boost:1.49.0 cpe:/a:boost:boost:1.50.0 cpe:/a:boost:boost:1.51.0 cpe:/a:boost:boost:1.52.0

CVE-2013-0252

2013-03-12T18:55:01.707-04:00

2013-12-05T00:22:26.120-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699649 MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699650 FEDORA FEDORA-2013-2420 FEDORA FEDORA-2013-2448 CONFIRM http://www.boost.org/users/news/boost_locale_security_notice.html MANDRIVA MDVSA-2013:065 MLIST [oss-security] 20130203 Re: CVE id request: boost BID 57675 UBUNTU USN-1727-1 MISC https://bugzilla.redhat.com/show_bug.cgi?id=907481 CONFIRM https://svn.boost.org/trac/boost/ticket/7743 boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.

cpe:/a:apache:maven:3.0.4

CVE-2013-0253

2013-04-09T16:55:01.617-04:00

2019-04-16T14:29:00.717-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2013:0700 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=917084 MLIST [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 CONFIRM https://maven.apache.org/security.html The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.

cpe:/a:digia:qt:1.41 cpe:/a:digia:qt:1.42 cpe:/a:digia:qt:1.43 cpe:/a:digia:qt:1.44 cpe:/a:digia:qt:1.45 cpe:/a:digia:qt:2.0.0 cpe:/a:digia:qt:2.0.1 cpe:/a:digia:qt:2.0.2 cpe:/a:digia:qt:3.3.0 cpe:/a:digia:qt:3.3.1 cpe:/a:digia:qt:3.3.2 cpe:/a:digia:qt:3.3.3 cpe:/a:digia:qt:3.3.4 cpe:/a:digia:qt:3.3.5 cpe:/a:digia:qt:3.3.6 cpe:/a:digia:qt:4.0.0 cpe:/a:digia:qt:4.0.1 cpe:/a:digia:qt:4.1.0 cpe:/a:digia:qt:4.1.1 cpe:/a:digia:qt:4.1.2 cpe:/a:digia:qt:4.1.3 cpe:/a:digia:qt:4.1.4 cpe:/a:digia:qt:4.1.5 cpe:/a:digia:qt:4.2.0 cpe:/a:digia:qt:4.2.1 cpe:/a:digia:qt:4.2.3 cpe:/a:digia:qt:4.3.0 cpe:/a:digia:qt:4.3.1 cpe:/a:digia:qt:4.3.2 cpe:/a:digia:qt:4.3.3 cpe:/a:digia:qt:4.3.4 cpe:/a:digia:qt:4.3.5 cpe:/a:digia:qt:4.4.0 cpe:/a:digia:qt:4.4.1 cpe:/a:digia:qt:4.4.2 cpe:/a:digia:qt:4.4.3 cpe:/a:digia:qt:4.5.0 cpe:/a:digia:qt:4.5.1 cpe:/a:digia:qt:4.5.2 cpe:/a:digia:qt:4.5.3 cpe:/a:digia:qt:4.6.0 cpe:/a:digia:qt:4.6.1 cpe:/a:digia:qt:4.6.2 cpe:/a:digia:qt:4.6.3 cpe:/a:digia:qt:4.6.4 cpe:/a:digia:qt:4.6.5 cpe:/a:digia:qt:4.7.0 cpe:/a:digia:qt:4.7.1 cpe:/a:digia:qt:4.7.2 cpe:/a:digia:qt:4.7.3 cpe:/a:digia:qt:4.7.4 cpe:/a:digia:qt:4.7.5 cpe:/a:digia:qt:4.7.6 cpe:/a:digia:qt:4.8.0 cpe:/a:digia:qt:4.8.1 cpe:/a:digia:qt:4.8.2 cpe:/a:digia:qt:4.8.3 cpe:/a:digia:qt:4.8.4 cpe:/a:digia:qt:4.8.5 cpe:/a:digia:qt:5.0.0 cpe:/a:digia:qt:5.0.1

CVE-2013-0254

2013-02-06T07:05:43.647-05:00

2013-05-14T23:34:05.970-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2013:0403 SUSE openSUSE-SU-2013:0404 SUSE openSUSE-SU-2013:0411 MLIST [qt-announce] 20130205 [Announce] [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable REDHAT RHSA-2013:0669 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=907425 The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.

cpe:/a:postgresql:postgresql:8.3 cpe:/a:postgresql:postgresql:8.3.1 cpe:/a:postgresql:postgresql:8.3.2 cpe:/a:postgresql:postgresql:8.3.3 cpe:/a:postgresql:postgresql:8.3.4 cpe:/a:postgresql:postgresql:8.3.5 cpe:/a:postgresql:postgresql:8.3.6 cpe:/a:postgresql:postgresql:8.3.7 cpe:/a:postgresql:postgresql:8.3.8 cpe:/a:postgresql:postgresql:8.3.9 cpe:/a:postgresql:postgresql:8.3.10 cpe:/a:postgresql:postgresql:8.3.11 cpe:/a:postgresql:postgresql:8.3.12 cpe:/a:postgresql:postgresql:8.3.13 cpe:/a:postgresql:postgresql:8.3.14 cpe:/a:postgresql:postgresql:8.3.15 cpe:/a:postgresql:postgresql:8.3.16 cpe:/a:postgresql:postgresql:8.3.17 cpe:/a:postgresql:postgresql:8.3.18 cpe:/a:postgresql:postgresql:8.3.19 cpe:/a:postgresql:postgresql:8.3.20 cpe:/a:postgresql:postgresql:8.3.21 cpe:/a:postgresql:postgresql:8.3.22 cpe:/a:postgresql:postgresql:8.4 cpe:/a:postgresql:postgresql:8.4.1 cpe:/a:postgresql:postgresql:8.4.2 cpe:/a:postgresql:postgresql:8.4.3 cpe:/a:postgresql:postgresql:8.4.4 cpe:/a:postgresql:postgresql:8.4.5 cpe:/a:postgresql:postgresql:8.4.6 cpe:/a:postgresql:postgresql:8.4.7 cpe:/a:postgresql:postgresql:8.4.8 cpe:/a:postgresql:postgresql:8.4.9 cpe:/a:postgresql:postgresql:8.4.10 cpe:/a:postgresql:postgresql:8.4.11 cpe:/a:postgresql:postgresql:8.4.12 cpe:/a:postgresql:postgresql:8.4.13 cpe:/a:postgresql:postgresql:8.4.14 cpe:/a:postgresql:postgresql:8.4.15 cpe:/a:postgresql:postgresql:9.0 cpe:/a:postgresql:postgresql:9.0.1 cpe:/a:postgresql:postgresql:9.0.2 cpe:/a:postgresql:postgresql:9.0.3 cpe:/a:postgresql:postgresql:9.0.4 cpe:/a:postgresql:postgresql:9.0.5 cpe:/a:postgresql:postgresql:9.0.6 cpe:/a:postgresql:postgresql:9.0.7 cpe:/a:postgresql:postgresql:9.0.8 cpe:/a:postgresql:postgresql:9.0.9 cpe:/a:postgresql:postgresql:9.0.10 cpe:/a:postgresql:postgresql:9.0.11 cpe:/a:postgresql:postgresql:9.1 cpe:/a:postgresql:postgresql:9.1.1 cpe:/a:postgresql:postgresql:9.1.2 cpe:/a:postgresql:postgresql:9.1.3 cpe:/a:postgresql:postgresql:9.1.4 cpe:/a:postgresql:postgresql:9.1.5 cpe:/a:postgresql:postgresql:9.1.6 cpe:/a:postgresql:postgresql:9.1.7

CVE-2013-0255

2013-02-12T20:55:04.590-05:00

2017-10-19T21:29:00.427-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov FEDORA FEDORA-2013-2123 SUSE openSUSE-SU-2013:0318 SUSE openSUSE-SU-2013:0319 REDHAT RHSA-2013:1475 DEBIAN DSA-2630 MANDRIVA MDVSA-2013:142 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.postgresql.org/docs/8.3/static/release-8-3-23.html CONFIRM http://www.postgresql.org/docs/8.4/static/release-8-4-16.html CONFIRM http://www.postgresql.org/docs/9.0/static/release-9-0-12.html CONFIRM http://www.postgresql.org/docs/9.1/static/release-9-1-8.html CONFIRM http://www.postgresql.org/docs/9.2/static/release-9-2-3.html BID 57844 UBUNTU USN-1717-1 CONFIRM https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=907892 XF postgresql-enumrecv-dos(81917) PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.

cpe:/a:dave_thomas:rdoc:2.3.0 cpe:/a:dave_thomas:rdoc:3.12 cpe:/a:dave_thomas:rdoc:4.0.0 cpe:/a:ruby-lang:ruby:1.9 cpe:/a:ruby-lang:ruby:1.9.1 cpe:/a:ruby-lang:ruby:1.9.2 cpe:/a:ruby-lang:ruby:1.9.3 cpe:/a:ruby-lang:ruby:1.9.3:p0 cpe:/a:ruby-lang:ruby:1.9.3:p125 cpe:/a:ruby-lang:ruby:1.9.3:p194 cpe:/a:ruby-lang:ruby:1.9.3:p286 cpe:/a:ruby-lang:ruby:1.9.3:p383 cpe:/a:ruby-lang:ruby:2.0 cpe:/a:ruby-lang:ruby:2.0.0 cpe:/a:ruby-lang:ruby:2.0.0:rc1 cpe:/a:ruby-lang:ruby:2.0.0:rc2

CVE-2013-0256

2013-03-01T00:40:17.583-05:00

2013-06-04T23:40:39.333-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2 SUSE SUSE-SU-2013:0647 SUSE openSUSE-SU-2013:0303 REDHAT RHSA-2013:0548 REDHAT RHSA-2013:0686 REDHAT RHSA-2013:0701 REDHAT RHSA-2013:0728 CONFIRM http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/ UBUNTU USN-1733-1 MISC https://bugzilla.redhat.com/show_bug.cgi?id=907820 CONFIRM https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60 darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

cpe:/a:david_alkire:email2image:6.x-1.x cpe:/a:david_alkire:email2image:6.x-2.x

CVE-2013-0257

2013-03-27T17:55:02.127-04:00

2013-03-28T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T10:17:00.000-04:00

MISC http://drupal.org/node/1903264 MLIST [oss-security] 20130204 Re: CVE request for Drupal contributed modules The email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes, which allows remote attackers to read images of user email addresses and email fields.

cpe:/a:google_authenticator_login_project:ga_login:7.x-1.0 cpe:/a:google_authenticator_login_project:ga_login:7.x-1.0:beta1 cpe:/a:google_authenticator_login_project:ga_login:7.x-1.0:dev cpe:/a:google_authenticator_login_project:ga_login:7.x-1.1 cpe:/a:google_authenticator_login_project:ga_login:7.x-1.2

CVE-2013-0258

2013-03-27T17:55:02.143-04:00

2013-04-05T00:00:00.000-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-28T10:42:00.000-04:00

CONFIRM http://drupal.org/node/1902102 MISC http://drupal.org/node/1903282 CONFIRM http://drupalcode.org/project/ga_login.git/commitdiff/50b032d MLIST [oss-security] 20130204 Re: CVE request for Drupal contributed modules The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.

cpe:/a:boxes_project:boxes:7.x-1.0 cpe:/a:boxes_project:boxes:7.x-1.0:beta1 cpe:/a:boxes_project:boxes:7.x-1.0:beta2 cpe:/a:boxes_project:boxes:7.x-1.0:beta3 cpe:/a:boxes_project:boxes:7.x-1.0:beta4 cpe:/a:boxes_project:boxes:7.x-1.0:beta5 cpe:/a:boxes_project:boxes:7.x-1.0:beta6 cpe:/a:boxes_project:boxes:7.x-1.0:beta7 cpe:/a:boxes_project:boxes:7.x-1.0:beta8 cpe:/a:boxes_project:boxes:7.x-1.x:dev

CVE-2013-0259

2013-03-27T17:55:02.160-04:00

2013-07-03T00:29:34.237-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://drupal.org/node/1897016 MISC http://drupal.org/node/1903300 CONFIRM http://drupalcode.org/project/boxes.git/commitdiff/456ff8e MLIST [oss-security] 20130204 Re: CVE request for Drupal contributed modules BID 57642 Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.

cpe:/a:elliot_pahl:drush_debian_packaging:-

CVE-2013-0260

2013-03-27T17:55:02.177-04:00

2013-03-28T00:00:00.000-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T10:48:00.000-04:00

MISC http://drupal.org/node/1903324 MLIST [oss-security] 20130204 Re: CVE request for Drupal contributed modules Unspecified vulnerability in the Drush Debian Packaging module for Drupal allows local users to obtain database credentials via unknown vectors.

cpe:/a:openstack:essex:- cpe:/a:openstack:folsom:-

CVE-2013-0261

2013-03-08T16:55:01.947-05:00

2013-03-18T00:00:00.000-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-18T11:02:00.000-04:00

REDHAT RHSA-2013:0595 MISC https://bugzilla.redhat.com/show_bug.cgi?id=908101 (1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

cpe:/a:rack_project:rack:1.4.0 cpe:/a:rack_project:rack:1.4.1 cpe:/a:rack_project:rack:1.4.2 cpe:/a:rack_project:rack:1.4.3 cpe:/a:rack_project:rack:1.4.4 cpe:/a:rack_project:rack:1.5.0 cpe:/a:rack_project:rack:1.5.1

CVE-2013-0262

2013-02-08T15:55:01.577-05:00

2018-08-13T17:47:43.667-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2013:0462 CONFIRM http://rack.github.com/ MISC https://bugzilla.redhat.com/show_bug.cgi?id=909071 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=909072 MISC https://gist.github.com/rentzsch/4736940 MISC https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56 CONFIRM https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30 CONFIRM https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ CONFIRM https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

cpe:/a:rack_project:rack:1.1.0 cpe:/a:rack_project:rack:1.1.4 cpe:/a:rack_project:rack:1.1.5 cpe:/a:rack_project:rack:1.1.6 cpe:/a:rack_project:rack:1.2.0 cpe:/a:rack_project:rack:1.2.1 cpe:/a:rack_project:rack:1.2.2 cpe:/a:rack_project:rack:1.2.3 cpe:/a:rack_project:rack:1.2.4 cpe:/a:rack_project:rack:1.2.6 cpe:/a:rack_project:rack:1.2.7 cpe:/a:rack_project:rack:1.3.0 cpe:/a:rack_project:rack:1.3.1 cpe:/a:rack_project:rack:1.3.2 cpe:/a:rack_project:rack:1.3.3 cpe:/a:rack_project:rack:1.3.4 cpe:/a:rack_project:rack:1.3.5 cpe:/a:rack_project:rack:1.3.6 cpe:/a:rack_project:rack:1.3.7 cpe:/a:rack_project:rack:1.3.8 cpe:/a:rack_project:rack:1.3.9 cpe:/a:rack_project:rack:1.4.0 cpe:/a:rack_project:rack:1.4.1 cpe:/a:rack_project:rack:1.4.2 cpe:/a:rack_project:rack:1.4.3 cpe:/a:rack_project:rack:1.4.4 cpe:/a:rack_project:rack:1.5.0 cpe:/a:rack_project:rack:1.5.1

CVE-2013-0263

2013-02-08T15:55:01.640-05:00

2018-08-13T17:47:43.853-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2013:0462 CONFIRM http://rack.github.com/ REDHAT RHSA-2013:0686 DEBIAN DSA-2783 MISC https://bugzilla.redhat.com/show_bug.cgi?id=909071 MISC https://gist.github.com/codahale/f9f3781f7b54985bee94 CONFIRM https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07 CONFIRM https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11 CONFIRM https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J CONFIRM https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ CONFIRM https://groups.google.com/forum/#!msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ CONFIRM https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ CONFIRM https://groups.google.com/forum/#!msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ CONFIRM https://puppet.com/security/cve/cve-2013-0263 MISC https://twitter.com/coda/statuses/299732877745197056 Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

cpe:/a:bitbucket:xnbd:0.1.0:pre

CVE-2013-0265

2013-02-12T20:55:04.700-05:00

2013-02-13T00:00:00.000-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-13T11:19:00.000-05:00

MLIST [oss-security] 20130206 CVE request: Insecure default log file path in xNBD MLIST [oss-security] 20130206 Re: CVE request: Insecure default log file path in xNBD The redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow local users to overwrite arbitrary files via a symlink attack on /tmp/xnbd.log.

cpe:/a:openstack:essex:- cpe:/a:openstack:folsom:-

CVE-2013-0266

2013-03-08T16:55:01.960-05:00

2013-03-18T00:00:00.000-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-18T11:40:00.000-04:00

REDHAT RHSA-2013:0595 MISC https://bugzilla.redhat.com/show_bug.cgi?id=908581 CONFIRM https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.

cpe:/a:apache:vcl:2.1 cpe:/a:apache:vcl:2.2 cpe:/a:apache:vcl:2.2.1 cpe:/a:apache:vcl:2.2.2 cpe:/a:apache:vcl:2.3 cpe:/a:apache:vcl:2.3.1

CVE-2013-0267

2018-02-21T10:29:00.213-05:00

2019-07-29T13:15:10.887-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM https://github.com/apache/vcl/commit/56c0f040056d6ad8693b20cfd3351367c2ffeabc#diff-2567a5ec9705eb7ac2c984033e06189d MLIST [vcl-commits] 20190729 svn commit: r1863947 - /vcl/site/trunk/content/security.mdtext MLIST [vcl-commits] 20190729 svn commit: r1048217 - in /websites/staging/vcl/trunk/content: ./ security.html MLIST [www-announce] 20130506 Apache VCL improper input validation The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of service, or conduct cross-site scripting (XSS) attacks by leveraging improper data validation.

CVE-2013-0268

2013-02-17T23:41:50.417-05:00

2013-08-22T02:48:38.537-04:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c903f0456bc69176912dee6dd25c6a66ee1aed00 SUSE SUSE-SU-2013:0674 SUSE openSUSE-SU-2013:1187 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6 MLIST [oss-security] 20130207 Re: CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=908693 CONFIRM https://github.com/torvalds/linux/commit/c903f0456bc69176912dee6dd25c6a66ee1aed00 The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.

cpe:/a:rubygems:json_gem:1.5.0 cpe:/a:rubygems:json_gem:1.5.1 cpe:/a:rubygems:json_gem:1.5.2 cpe:/a:rubygems:json_gem:1.5.3 cpe:/a:rubygems:json_gem:1.5.4 cpe:/a:rubygems:json_gem:1.6.0 cpe:/a:rubygems:json_gem:1.6.1 cpe:/a:rubygems:json_gem:1.6.2 cpe:/a:rubygems:json_gem:1.6.3 cpe:/a:rubygems:json_gem:1.6.4 cpe:/a:rubygems:json_gem:1.6.5 cpe:/a:rubygems:json_gem:1.6.6 cpe:/a:rubygems:json_gem:1.6.7 cpe:/a:rubygems:json_gem:1.7.0 cpe:/a:rubygems:json_gem:1.7.1 cpe:/a:rubygems:json_gem:1.7.2 cpe:/a:rubygems:json_gem:1.7.3 cpe:/a:rubygems:json_gem:1.7.4 cpe:/a:rubygems:json_gem:1.7.5 cpe:/a:rubygems:json_gem:1.7.6

CVE-2013-0269

2013-02-12T20:55:05.107-05:00

2017-12-08T21:29:01.297-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2013-10-22-5 SUSE SUSE-SU-2013:0609 SUSE SUSE-SU-2013:0647 SUSE openSUSE-SU-2013:0603 REDHAT RHSA-2013:0686 REDHAT RHSA-2013:0701 REDHAT RHSA-2013:1028 REDHAT RHSA-2013:1147 CONFIRM http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed CONFIRM http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ MLIST [oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] MLIST [oss-security] 20130211 Patch update for [CVE-2013-0269] BID 57899 SLACKWARE SSA:2013-075-01 UBUNTU USN-1733-1 MISC http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection XF json-ruby-security-bypass(82010) MLIST [rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] CONFIRM https://puppet.com/security/cve/cve-2013-0269 The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

cpe:/a:openstack:keystone:2012.1 cpe:/a:openstack:keystone:2012.1.1 cpe:/a:openstack:keystone:2012.1.2 cpe:/a:openstack:keystone:2012.1.3 cpe:/a:openstack:keystone:2012.2 cpe:/a:openstack:keystone:2012.2.1 cpe:/a:openstack:keystone:2012.2.2 cpe:/a:openstack:keystone:2012.2.3 cpe:/a:openstack:keystone:2012.2.4 cpe:/a:openstack:keystone:2013.1:milestone1 cpe:/a:openstack:keystone:2013.1:milestone2 cpe:/a:openstack:keystone:2013.1:milestone3

CVE-2013-0270

2013-04-12T18:55:01.070-04:00

2018-11-16T09:38:42.353-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-11-15T13:12:36.363-05:00

REDHAT RHSA-2013:0708 CONFIRM https://bugs.launchpad.net/keystone/+bug/1099025 MISC https://bugzilla.redhat.com/show_bug.cgi?id=909012 CONFIRM https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8 CONFIRM https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc CONFIRM https://launchpad.net/keystone/grizzly/2013.1 OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.

cpe:/a:pidgin:pidgin:2.0.0 cpe:/a:pidgin:pidgin:2.0.1 cpe:/a:pidgin:pidgin:2.0.2 cpe:/a:pidgin:pidgin:2.1.0 cpe:/a:pidgin:pidgin:2.1.1 cpe:/a:pidgin:pidgin:2.2.0 cpe:/a:pidgin:pidgin:2.2.1 cpe:/a:pidgin:pidgin:2.2.2 cpe:/a:pidgin:pidgin:2.3.0 cpe:/a:pidgin:pidgin:2.3.1 cpe:/a:pidgin:pidgin:2.4.0 cpe:/a:pidgin:pidgin:2.4.1 cpe:/a:pidgin:pidgin:2.4.2 cpe:/a:pidgin:pidgin:2.4.3 cpe:/a:pidgin:pidgin:2.5.0 cpe:/a:pidgin:pidgin:2.5.1 cpe:/a:pidgin:pidgin:2.5.2 cpe:/a:pidgin:pidgin:2.5.3 cpe:/a:pidgin:pidgin:2.5.4 cpe:/a:pidgin:pidgin:2.5.5 cpe:/a:pidgin:pidgin:2.5.6 cpe:/a:pidgin:pidgin:2.5.7 cpe:/a:pidgin:pidgin:2.5.8 cpe:/a:pidgin:pidgin:2.5.9 cpe:/a:pidgin:pidgin:2.6.0 cpe:/a:pidgin:pidgin:2.6.1 cpe:/a:pidgin:pidgin:2.6.2 cpe:/a:pidgin:pidgin:2.6.4 cpe:/a:pidgin:pidgin:2.6.5 cpe:/a:pidgin:pidgin:2.6.6 cpe:/a:pidgin:pidgin:2.7.0 cpe:/a:pidgin:pidgin:2.7.1 cpe:/a:pidgin:pidgin:2.7.2 cpe:/a:pidgin:pidgin:2.7.3 cpe:/a:pidgin:pidgin:2.7.4 cpe:/a:pidgin:pidgin:2.7.5 cpe:/a:pidgin:pidgin:2.7.6 cpe:/a:pidgin:pidgin:2.7.7 cpe:/a:pidgin:pidgin:2.7.8 cpe:/a:pidgin:pidgin:2.7.9 cpe:/a:pidgin:pidgin:2.7.10 cpe:/a:pidgin:pidgin:2.7.11 cpe:/a:pidgin:pidgin:2.8.0 cpe:/a:pidgin:pidgin:2.9.0 cpe:/a:pidgin:pidgin:2.10.0 cpe:/a:pidgin:pidgin:2.10.1 cpe:/a:pidgin:pidgin:2.10.2 cpe:/a:pidgin:pidgin:2.10.3 cpe:/a:pidgin:pidgin:2.10.4 cpe:/a:pidgin:pidgin:2.10.5 cpe:/a:pidgin:pidgin:2.10.6

CVE-2013-0271

2013-02-16T16:55:02.093-05:00

2017-09-18T21:35:36.730-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2 SUSE SUSE-SU-2013:0388 SUSE openSUSE-SU-2013:0405 CONFIRM http://www.pidgin.im/news/security/?id=65 UBUNTU USN-1746-1 The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.

CVE-2013-0272

2013-02-16T16:55:02.153-05:00

2017-09-18T21:35:36.793-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c SUSE SUSE-SU-2013:0388 SUSE openSUSE-SU-2013:0405 SUSE openSUSE-SU-2013:0407 CONFIRM http://www.pidgin.im/news/security/?id=66 BID 57951 UBUNTU USN-1746-1 Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.

CVE-2013-0273

2013-02-16T16:55:02.233-05:00

2017-09-18T21:35:36.857-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd SUSE SUSE-SU-2013:0388 SUSE openSUSE-SU-2013:0405 SUSE openSUSE-SU-2013:0407 CONFIRM http://www.pidgin.im/news/security/?id=67 UBUNTU USN-1746-1 sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.

CVE-2013-0274

2013-02-16T16:55:02.280-05:00

2017-09-18T21:35:36.933-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3 SUSE SUSE-SU-2013:0388 SUSE openSUSE-SU-2013:0405 SUSE openSUSE-SU-2013:0407 CONFIRM http://www.pidgin.im/news/security/?id=68 UBUNTU USN-1746-1 upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.

cpe:/a:ganglia:ganglia-web:2.1.0 cpe:/a:ganglia:ganglia-web:2.1.1 cpe:/a:ganglia:ganglia-web:2.1.2 cpe:/a:ganglia:ganglia-web:2.1.3 cpe:/a:ganglia:ganglia-web:2.1.5 cpe:/a:ganglia:ganglia-web:2.1.6 cpe:/a:ganglia:ganglia-web:2.1.7 cpe:/a:ganglia:ganglia-web:2.1.8 cpe:/a:ganglia:ganglia-web:2.2.0 cpe:/a:ganglia:ganglia-web:3.3.0 cpe:/a:ganglia:ganglia-web:3.3.1 cpe:/a:ganglia:ganglia-web:3.4.1 cpe:/a:ganglia:ganglia-web:3.4.2 cpe:/a:ganglia:ganglia-web:3.5.0 cpe:/a:ganglia:ganglia-web:3.5.1 cpe:/a:ganglia:ganglia-web:3.5.2 cpe:/a:ganglia:ganglia-web:3.5.3 cpe:/a:ganglia:ganglia-web:3.5.4 cpe:/a:ganglia:ganglia-web:3.5.5

CVE-2013-0275

2013-03-13T23:12:47.400-04:00

2013-03-19T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-19T13:18:00.000-04:00

CONFIRM http://ganglia.info/?p=566 MLIST [oss-security] 20130208 Re: CVE request: XSS flaws fixed in ganglia BID 58204 MISC https://bugzilla.redhat.com/show_bug.cgi?id=892823 CONFIRM https://github.com/ganglia/ganglia-web/commit/31d348947419058c43b8dfcd062e2988abd5058e Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:rubyonrails:rails:2.3.0 cpe:/a:rubyonrails:rails:2.3.1 cpe:/a:rubyonrails:rails:2.3.2 cpe:/a:rubyonrails:rails:2.3.3 cpe:/a:rubyonrails:rails:2.3.4 cpe:/a:rubyonrails:rails:2.3.9 cpe:/a:rubyonrails:rails:2.3.10 cpe:/a:rubyonrails:rails:2.3.11 cpe:/a:rubyonrails:rails:2.3.12 cpe:/a:rubyonrails:rails:2.3.13 cpe:/a:rubyonrails:rails:2.3.14 cpe:/a:rubyonrails:rails:2.3.15 cpe:/a:rubyonrails:rails:2.3.16 cpe:/a:rubyonrails:rails:3.1.0 cpe:/a:rubyonrails:rails:3.1.0:beta1 cpe:/a:rubyonrails:rails:3.1.0:rc1 cpe:/a:rubyonrails:rails:3.1.0:rc2 cpe:/a:rubyonrails:rails:3.1.0:rc3 cpe:/a:rubyonrails:rails:3.1.0:rc4 cpe:/a:rubyonrails:rails:3.1.0:rc5 cpe:/a:rubyonrails:rails:3.1.0:rc6 cpe:/a:rubyonrails:rails:3.1.0:rc7 cpe:/a:rubyonrails:rails:3.1.0:rc8 cpe:/a:rubyonrails:rails:3.1.1 cpe:/a:rubyonrails:rails:3.1.1:rc1 cpe:/a:rubyonrails:rails:3.1.1:rc2 cpe:/a:rubyonrails:rails:3.1.1:rc3 cpe:/a:rubyonrails:rails:3.1.2 cpe:/a:rubyonrails:rails:3.1.2:rc1 cpe:/a:rubyonrails:rails:3.1.2:rc2 cpe:/a:rubyonrails:rails:3.1.3 cpe:/a:rubyonrails:rails:3.1.4 cpe:/a:rubyonrails:rails:3.1.4:rc1 cpe:/a:rubyonrails:rails:3.1.5 cpe:/a:rubyonrails:rails:3.1.5:rc1 cpe:/a:rubyonrails:rails:3.1.6 cpe:/a:rubyonrails:rails:3.1.7 cpe:/a:rubyonrails:rails:3.1.8 cpe:/a:rubyonrails:rails:3.1.9 cpe:/a:rubyonrails:rails:3.1.10 cpe:/a:rubyonrails:rails:3.2.0 cpe:/a:rubyonrails:rails:3.2.0:rc1 cpe:/a:rubyonrails:rails:3.2.0:rc2 cpe:/a:rubyonrails:rails:3.2.1 cpe:/a:rubyonrails:rails:3.2.2 cpe:/a:rubyonrails:rails:3.2.2:rc1 cpe:/a:rubyonrails:rails:3.2.3 cpe:/a:rubyonrails:rails:3.2.3:rc1 cpe:/a:rubyonrails:rails:3.2.3:rc2 cpe:/a:rubyonrails:rails:3.2.4 cpe:/a:rubyonrails:rails:3.2.4:rc1 cpe:/a:rubyonrails:rails:3.2.5 cpe:/a:rubyonrails:rails:3.2.6 cpe:/a:rubyonrails:rails:3.2.7 cpe:/a:rubyonrails:rails:3.2.8 cpe:/a:rubyonrails:rails:3.2.9 cpe:/a:rubyonrails:rails:3.2.10 cpe:/a:rubyonrails:rails:3.2.11

CVE-2013-0276

2013-02-12T20:55:05.167-05:00

2019-08-08T11:42:45.623-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov APPLE APPLE-SA-2013-06-04-1 SUSE openSUSE-SU-2013:0462 REDHAT RHSA-2013:0686 CONFIRM http://support.apple.com/kb/HT5784 CONFIRM http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ DEBIAN DSA-2620 MLIST [oss-security] 20130211 Circumvention of attr_protected [CVE-2013-0276] BID 57896 MLIST [rubyonrails-security] 20130211 Circumvention of attr_protected [CVE-2013-0276] ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

cpe:/a:rubyonrails:rails:2.3.0 cpe:/a:rubyonrails:rails:2.3.1 cpe:/a:rubyonrails:rails:2.3.2 cpe:/a:rubyonrails:rails:2.3.3 cpe:/a:rubyonrails:rails:2.3.4 cpe:/a:rubyonrails:rails:2.3.9 cpe:/a:rubyonrails:rails:2.3.10 cpe:/a:rubyonrails:rails:2.3.11 cpe:/a:rubyonrails:rails:2.3.12 cpe:/a:rubyonrails:rails:2.3.13 cpe:/a:rubyonrails:rails:2.3.14 cpe:/a:rubyonrails:rails:2.3.15 cpe:/a:rubyonrails:rails:2.3.16 cpe:/a:rubyonrails:rails:3.0.0 cpe:/a:rubyonrails:rails:3.0.0:beta cpe:/a:rubyonrails:rails:3.0.0:beta2 cpe:/a:rubyonrails:rails:3.0.0:beta3 cpe:/a:rubyonrails:rails:3.0.0:beta4 cpe:/a:rubyonrails:rails:3.0.0:rc cpe:/a:rubyonrails:rails:3.0.0:rc2 cpe:/a:rubyonrails:rails:3.0.1 cpe:/a:rubyonrails:rails:3.0.1:pre cpe:/a:rubyonrails:rails:3.0.2 cpe:/a:rubyonrails:rails:3.0.2:pre cpe:/a:rubyonrails:rails:3.0.3 cpe:/a:rubyonrails:rails:3.0.4:rc1 cpe:/a:rubyonrails:rails:3.0.5 cpe:/a:rubyonrails:rails:3.0.5:rc1 cpe:/a:rubyonrails:rails:3.0.6 cpe:/a:rubyonrails:rails:3.0.6:rc1 cpe:/a:rubyonrails:rails:3.0.6:rc2 cpe:/a:rubyonrails:rails:3.0.7 cpe:/a:rubyonrails:rails:3.0.7:rc1 cpe:/a:rubyonrails:rails:3.0.7:rc2 cpe:/a:rubyonrails:rails:3.0.8 cpe:/a:rubyonrails:rails:3.0.8:rc1 cpe:/a:rubyonrails:rails:3.0.8:rc2 cpe:/a:rubyonrails:rails:3.0.8:rc3 cpe:/a:rubyonrails:rails:3.0.8:rc4 cpe:/a:rubyonrails:rails:3.0.9 cpe:/a:rubyonrails:rails:3.0.9:rc1 cpe:/a:rubyonrails:rails:3.0.9:rc2 cpe:/a:rubyonrails:rails:3.0.9:rc3 cpe:/a:rubyonrails:rails:3.0.9:rc4 cpe:/a:rubyonrails:rails:3.0.9:rc5 cpe:/a:rubyonrails:rails:3.0.10 cpe:/a:rubyonrails:rails:3.0.10:rc1 cpe:/a:rubyonrails:rails:3.0.11 cpe:/a:rubyonrails:rails:3.0.12 cpe:/a:rubyonrails:rails:3.0.12:rc1 cpe:/a:rubyonrails:rails:3.0.13 cpe:/a:rubyonrails:rails:3.0.13:rc1 cpe:/a:rubyonrails:rails:3.0.14 cpe:/a:rubyonrails:rails:3.0.16 cpe:/a:rubyonrails:rails:3.0.17 cpe:/a:rubyonrails:rails:3.0.18 cpe:/a:rubyonrails:rails:3.0.19 cpe:/a:rubyonrails:rails:3.0.20 cpe:/a:rubyonrails:ruby_on_rails:3.0.4

CVE-2013-0277

2013-02-12T20:55:05.230-05:00

2019-08-08T11:42:27.043-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov APPLE APPLE-SA-2013-06-04-1 SUSE openSUSE-SU-2013:0462 SECTRACK 1028109 CONFIRM http://support.apple.com/kb/HT5784 CONFIRM http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ DEBIAN DSA-2620 MLIST [oss-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277] MLIST [rubyonrails-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277] CONFIRM https://puppet.com/security/cve/cve-2013-0277 ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

CVE-2013-0278

2013-04-02T20:55:01.330-04:00

2013-04-02T20:55:01.633-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2013-0279

2013-04-02T20:55:01.663-04:00

2013-04-02T20:55:01.897-04:00

CVE-2013-0280

2013-04-02T20:55:01.917-04:00

2013-04-02T20:55:02.147-04:00

cpe:/a:clusterlabs:pacemaker:1.1.10 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0281

2013-11-23T06:55:04.287-05:00

2019-04-22T13:48:00.643-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-11-25T10:40:11.040-05:00

REDHAT RHSA-2013:1635 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=891922 CONFIRM https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93 Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).

cpe:/a:openstack:keystone:2012.1 cpe:/a:openstack:keystone:2012.1.1 cpe:/a:openstack:keystone:2012.1.2 cpe:/a:openstack:keystone:2012.1.3 cpe:/a:openstack:keystone:2012.2 cpe:/a:openstack:keystone:2012.2.1 cpe:/a:openstack:keystone:2012.2.2 cpe:/a:openstack:keystone:2012.2.3 cpe:/a:openstack:keystone:2012.2.4 cpe:/a:openstack:keystone:2013.1:milestone1 cpe:/a:openstack:keystone:2013.1:milestone2 cpe:/a:openstack:keystone:2013.1:milestone3

CVE-2013-0282

2013-04-12T18:55:01.127-04:00

2018-11-16T09:45:28.763-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-11-15T13:19:41.730-05:00

MLIST [oss-security] 20130219 [OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282) CONFIRM https://bugs.launchpad.net/keystone/+bug/1121494 CONFIRM https://launchpad.net/keystone/+milestone/2012.2.4 CONFIRM https://launchpad.net/keystone/grizzly/2013.1 CONFIRM https://review.openstack.org/#/c/22319/ CONFIRM https://review.openstack.org/#/c/22320/ CONFIRM https://review.openstack.org/#/c/22321/ OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

cpe:/a:newrelic:ruby_agent:3.2.0 cpe:/a:newrelic:ruby_agent:3.3.0 cpe:/a:newrelic:ruby_agent:3.3.1 cpe:/a:newrelic:ruby_agent:3.3.2 cpe:/a:newrelic:ruby_agent:3.3.2.1 cpe:/a:newrelic:ruby_agent:3.3.3 cpe:/a:newrelic:ruby_agent:3.3.4 cpe:/a:newrelic:ruby_agent:3.3.4.1 cpe:/a:newrelic:ruby_agent:3.3.5 cpe:/a:newrelic:ruby_agent:3.4.0 cpe:/a:newrelic:ruby_agent:3.4.0.1 cpe:/a:newrelic:ruby_agent:3.4.1 cpe:/a:newrelic:ruby_agent:3.4.2 cpe:/a:newrelic:ruby_agent:3.4.2.1 cpe:/a:newrelic:ruby_agent:3.5.0 cpe:/a:newrelic:ruby_agent:3.5.0.1 cpe:/a:newrelic:ruby_agent:3.5.1 cpe:/a:newrelic:ruby_agent:3.5.1.14 cpe:/a:newrelic:ruby_agent:3.5.2

CVE-2013-0284

2013-04-09T16:55:01.647-04:00

2013-04-10T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-10T09:37:00.000-04:00

MLIST [oss-security] 20130213 Some rubygems related CVEs CONFIRM https://newrelic.com/docs/ruby/ruby-agent-security-notification Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.

cpe:/a:nori_gem_project:nori_gem:1.0.0 cpe:/a:nori_gem_project:nori_gem:1.0.1 cpe:/a:nori_gem_project:nori_gem:1.0.2 cpe:/a:nori_gem_project:nori_gem:1.1.0 cpe:/a:nori_gem_project:nori_gem:1.1.1 cpe:/a:nori_gem_project:nori_gem:1.1.2 cpe:/a:nori_gem_project:nori_gem:1.1.3 cpe:/a:nori_gem_project:nori_gem:2.0.0 cpe:/a:nori_gem_project:nori_gem:2.0.1

CVE-2013-0285

2013-04-09T16:55:01.677-04:00

2013-04-16T00:00:00.000-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-04-10T09:40:00.000-04:00

MLIST [oss-security] 20130213 Some rubygems related CVEs MISC https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

cpe:/a:fedoraproject:sssd:1.9.0 cpe:/a:fedoraproject:sssd:1.9.1 cpe:/a:fedoraproject:sssd:1.9.2 cpe:/a:fedoraproject:sssd:1.9.3 cpe:/a:fedoraproject:sssd:1.9.4

CVE-2013-0287

2013-03-21T12:55:02.557-04:00

2013-05-14T23:34:09.003-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93 CONFIRM http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1 SUSE openSUSE-SU-2013:0559 REDHAT RHSA-2013:0663 SECTRACK 1028317 BID 58593 MLIST [sssd-devel] 20130319 [SSSD] A security bug in SSSD 1.9 (CVE-2013-0287) The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.

cpe:/a:arthurdejong:nss-pam-ldapd:0.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.2 cpe:/a:arthurdejong:nss-pam-ldapd:0.2.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.3 cpe:/a:arthurdejong:nss-pam-ldapd:0.4 cpe:/a:arthurdejong:nss-pam-ldapd:0.4.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.5 cpe:/a:arthurdejong:nss-pam-ldapd:0.6 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.0 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.2 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.3 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.4 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.5 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.6 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.7 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.7.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.7.2 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.8 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.9 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.10 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.11 cpe:/a:arthurdejong:nss-pam-ldapd:0.6.12 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.0 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.2 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.3 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.4 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.5 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.6 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.7 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.8 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.9 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.10 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.11 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.12 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.13 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.14 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.15 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.16 cpe:/a:arthurdejong:nss-pam-ldapd:0.7.17 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.0 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.1 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.2 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.3 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.4 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.5 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.6 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.7 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.8 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.9 cpe:/a:arthurdejong:nss-pam-ldapd:0.8.10

CVE-2013-0288

2013-03-05T16:38:55.680-05:00

2017-08-28T21:33:01.073-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81 CONFIRM http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32 CONFIRM http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319 MLIST [nss-pam-ldapd-announce] 20130218 nss-pam-ldapd security advisory (CVE-2013-0288) FEDORA FEDORA-2013-2754 SUSE openSUSE-SU-2013:0522 SUSE openSUSE-SU-2013:0524 REDHAT RHSA-2013:0590 DEBIAN DSA-2628 MANDRIVA MDVSA-2013:106 MLIST [oss-security] 20130218 CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow BID 58007 MISC https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288 XF nsspamldapd-fdsetsize-bo(82175) CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071 nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.

cpe:/a:oswald_buddenhagen:isync:0.4 cpe:/a:oswald_buddenhagen:isync:0.5 cpe:/a:oswald_buddenhagen:isync:0.6 cpe:/a:oswald_buddenhagen:isync:0.7 cpe:/a:oswald_buddenhagen:isync:0.8 cpe:/a:oswald_buddenhagen:isync:1.0.0 cpe:/a:oswald_buddenhagen:isync:1.0.1 cpe:/a:oswald_buddenhagen:isync:1.0.2 cpe:/a:oswald_buddenhagen:isync:1.0.3 cpe:/a:oswald_buddenhagen:isync:1.0.4 cpe:/a:oswald_buddenhagen:isync:1.0.5

CVE-2013-0289

2014-05-23T10:55:08.943-04:00

2017-08-28T21:33:01.150-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2013-2795 FEDORA FEDORA-2013-2758 GENTOO GLSA-201310-02 CONFIRM http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb CONFIRM http://sourceforge.net/projects/isync/files/isync/1.0.6/ MLIST [oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289) BID 57423 XF isync-ssl-info-disc(82232) Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2013-0290

2013-02-19T14:55:01.003-05:00

2013-09-11T23:31:52.523-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=77c1090f94d1b0b5186fb13a1b71b47b1343f87f SUSE openSUSE-SU-2013:0951 SUSE openSUSE-SU-2013:1042 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.8.bz2 MANDRIVA MDVSA-2013:176 MLIST [oss-security] 20130214 Re: CVE Request: kernel -- local DOS (endless loop with interrupts disabled) CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=911473 CONFIRM https://github.com/torvalds/linux/commit/77c1090f94d1b0b5186fb13a1b71b47b1343f87f The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.

cpe:/a:freedesktop:dbus-glib:0.72 cpe:/a:freedesktop:dbus-glib:0.73 cpe:/a:freedesktop:dbus-glib:0.74 cpe:/a:freedesktop:dbus-glib:0.76 cpe:/a:freedesktop:dbus-glib:0.78 cpe:/a:freedesktop:dbus-glib:0.80 cpe:/a:freedesktop:dbus-glib:0.82 cpe:/a:freedesktop:dbus-glib:0.84 cpe:/a:freedesktop:dbus-glib:0.86 cpe:/a:freedesktop:dbus-glib:0.88 cpe:/a:freedesktop:dbus-glib:0.90 cpe:/a:freedesktop:dbus-glib:0.92 cpe:/a:freedesktop:dbus-glib:0.94 cpe:/a:freedesktop:dbus-glib:0.96 cpe:/a:freedesktop:dbus-glib:0.98 cpe:/a:freedesktop:dbus-glib:0.100

CVE-2013-0292

2013-03-05T16:38:56.227-05:00

2017-08-28T21:33:01.213-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658 CONFIRM http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 REDHAT RHSA-2013:0568 EXPLOIT-DB 33614 MANDRIVA MDVSA-2013:071 MLIST [oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1 CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html BID 57985 UBUNTU USN-1753-1 CONFIRM https://bugs.freedesktop.org/show_bug.cgi?id=60916 XF dbus-message-sender-priv-esc(82135) The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

cpe:/a:zlib:pigz:2.2.4-1

CVE-2013-0296

2014-04-27T17:55:05.570-04:00

2014-04-28T15:28:07.040-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-04-28T15:28:06.977-04:00

SUSE openSUSE-SU-2013:0540 MLIST [pigz-announce] 20120728 pigz version 2.2.5 released MLIST [oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions MLIST [oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure permissions CONFIRM https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608 Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.

cpe:/a:owncloud:owncloud:3.0.0 cpe:/a:owncloud:owncloud:3.0.1 cpe:/a:owncloud:owncloud:3.0.2 cpe:/a:owncloud:owncloud:3.0.3 cpe:/a:owncloud:owncloud:4.0.0 cpe:/a:owncloud:owncloud:4.0.1 cpe:/a:owncloud:owncloud:4.0.2 cpe:/a:owncloud:owncloud:4.0.3 cpe:/a:owncloud:owncloud:4.0.4 cpe:/a:owncloud:owncloud:4.0.5 cpe:/a:owncloud:owncloud:4.0.6 cpe:/a:owncloud:owncloud:4.0.7 cpe:/a:owncloud:owncloud:4.0.8 cpe:/a:owncloud:owncloud:4.0.9 cpe:/a:owncloud:owncloud:4.0.10 cpe:/a:owncloud:owncloud:4.0.11 cpe:/a:owncloud:owncloud:4.5.0 cpe:/a:owncloud:owncloud:4.5.1 cpe:/a:owncloud:owncloud:4.5.2 cpe:/a:owncloud:owncloud:4.5.3 cpe:/a:owncloud:owncloud:4.5.4 cpe:/a:owncloud:owncloud:4.5.5 cpe:/a:owncloud:owncloud:4.5.6

CVE-2013-0297

2014-03-14T11:55:05.387-04:00

2014-03-25T20:39:11.230-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-17T08:44:19.343-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-003/ Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.

cpe:/a:owncloud:owncloud:4.5.0 cpe:/a:owncloud:owncloud:4.5.1 cpe:/a:owncloud:owncloud:4.5.2 cpe:/a:owncloud:owncloud:4.5.3 cpe:/a:owncloud:owncloud:4.5.4 cpe:/a:owncloud:owncloud:4.5.5 cpe:/a:owncloud:owncloud:4.5.6

CVE-2013-0298

2014-03-14T11:55:05.417-04:00

2014-03-25T20:40:00.373-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-17T08:42:07.683-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-003/ Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.

CVE-2013-0299

2014-03-14T13:55:06.937-04:00

2014-03-25T16:49:34.783-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-03-17T11:11:14.560-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-004/ Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.

CVE-2013-0300

2014-03-14T13:55:06.953-04:00

2014-03-25T16:55:40.123-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-03-17T11:09:27.073-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-004/ Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.

CVE-2013-0301

2014-03-14T13:55:06.983-04:00

2014-03-25T16:56:05.623-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-03-17T11:08:01.210-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-004/ Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.

CVE-2013-0302

2014-06-05T11:44:07.527-04:00

2014-06-24T11:49:52.070-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-05T14:11:24.623-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-005/ Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.

cpe:/a:owncloud:owncloud:4.0.0 cpe:/a:owncloud:owncloud:4.0.1 cpe:/a:owncloud:owncloud:4.0.2 cpe:/a:owncloud:owncloud:4.0.3 cpe:/a:owncloud:owncloud:4.0.4 cpe:/a:owncloud:owncloud:4.0.5 cpe:/a:owncloud:owncloud:4.0.6 cpe:/a:owncloud:owncloud:4.0.7 cpe:/a:owncloud:owncloud:4.0.8 cpe:/a:owncloud:owncloud:4.0.9 cpe:/a:owncloud:owncloud:4.0.10 cpe:/a:owncloud:owncloud:4.0.11 cpe:/a:owncloud:owncloud:4.5.0 cpe:/a:owncloud:owncloud:4.5.1 cpe:/a:owncloud:owncloud:4.5.2 cpe:/a:owncloud:owncloud:4.5.3 cpe:/a:owncloud:owncloud:4.5.4 cpe:/a:owncloud:owncloud:4.5.5

CVE-2013-0303

2014-03-24T12:31:06.760-04:00

2014-03-24T12:38:17.963-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2014-03-24T12:38:17.760-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-006/ Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.

CVE-2013-0304

2014-06-05T11:44:07.743-04:00

2014-06-05T13:28:48.347-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2014-06-05T11:53:09.790-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-007/ MISC http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

cpe:/a:djangoproject:django:1.3 cpe:/a:djangoproject:django:1.3:alpha1 cpe:/a:djangoproject:django:1.3:beta1 cpe:/a:djangoproject:django:1.3.1 cpe:/a:djangoproject:django:1.3.2 cpe:/a:djangoproject:django:1.3.3 cpe:/a:djangoproject:django:1.4 cpe:/a:djangoproject:django:1.4:alpha cpe:/a:djangoproject:django:1.4:beta cpe:/a:djangoproject:django:1.4.1 cpe:/a:djangoproject:django:1.4.2 cpe:/a:djangoproject:django:1.5:alpha cpe:/a:djangoproject:django:1.5:beta cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0305

2013-05-02T10:55:05.257-04:00

2013-05-14T23:34:10.117-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2013:0670 UBUNTU USN-1757-1 DEBIAN DSA-2634 CONFIRM https://www.djangoproject.com/weblog/2013/feb/19/security/ The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

CVE-2013-0306

2013-05-02T10:55:05.277-04:00

2013-05-14T23:34:10.190-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0670 UBUNTU USN-1757-1 DEBIAN DSA-2634 CONFIRM https://www.djangoproject.com/weblog/2013/feb/19/security/ The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

CVE-2013-0307

2014-03-14T11:55:05.433-04:00

2014-03-25T20:41:13.203-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-03-17T08:41:02.603-04:00

CONFIRM http://owncloud.org/about/security/advisories/oC-SA-2013-003/ Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.

cpe:/a:git:git:1.8.1.3

CVE-2013-0308

2013-03-08T16:55:03.170-05:00

2017-08-28T21:33:01.307-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586 APPLE APPLE-SA-2013-09-18-3 SUSE openSUSE-SU-2013:0380 SUSE openSUSE-SU-2013:0382 MLIST [ANNOUNCE] 20130220 Git v1.8.1.4 REDHAT RHSA-2013:0589 CONFIRM http://support.apple.com/kb/HT5937 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html BID 58148 SECTRACK 1028205 MISC https://bugzilla.novell.com/show_bug.cgi?id=804730 MISC https://bugzilla.redhat.com/show_bug.cgi?id=909977 XF git-gitimapsend-spoofing(82329) CONFIRM https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2::~~~~x86~ cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.1::~~~~x86~ cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4::~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc1:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc2:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc3:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc4:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc5:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc6:~~~~x86~ cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4:rc7:~~~~x86~ cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.1::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.2::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.3::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.4::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.5::~~~~x86~ cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0309

2013-02-21T19:55:01.050-05:00

2019-04-22T13:48:00.643-04:00

4.7

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=027ef6c87853b0a9df53175063028edb4950d476 REDHAT RHSA-2013:0496 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.2 MLIST [oss-security] 20130219 Re: CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=912898 CONFIRM https://github.com/torvalds/linux/commit/027ef6c87853b0a9df53175063028edb4950d476 arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:redhat:enterprise_linux:6.0

CVE-2013-0310

2013-02-21T19:55:01.113-05:00

2019-04-22T13:48:00.643-04:00

6.6

LOCAL

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=89d7ae34cdda4195809a5a987f697a517a2a3177 REDHAT RHSA-2013:0496 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.8 MLIST [oss-security] 20130219 Re: CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=912900 CONFIRM https://github.com/torvalds/linux/commit/89d7ae34cdda4195809a5a987f697a517a2a3177 The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.

CVE-2013-0311

2013-02-21T19:55:01.193-05:00

2019-04-22T13:48:00.643-04:00

6.5

ADJACENT_NETWORK

HIGH

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85 SUSE openSUSE-SU-2013:1187 REDHAT RHSA-2013:0496 REDHAT RHSA-2013:0579 REDHAT RHSA-2013:0882 REDHAT RHSA-2013:0928 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2 MANDRIVA MDVSA-2013:176 MLIST [oss-security] 20130219 Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=912905 CONFIRM https://github.com/torvalds/linux/commit/bd97120fc3d1a11f3124c7c9ba1d91f51829eb85 The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.

cpe:/a:fedoraproject:389_directory_server:1.3.0.3

CVE-2013-0312

2013-03-13T16:55:02.173-04:00

2013-03-19T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-03-19T10:42:00.000-04:00

CONFIRM http://directory.fedoraproject.org/wiki/Releases/1.3.0.4 REDHAT RHSA-2013:0628 BID 58428 MISC https://bugzilla.redhat.com/show_bug.cgi?id=912964 MISC https://fedorahosted.org/389/ticket/571 389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.

CVE-2013-0313

2013-02-21T19:55:01.240-05:00

2013-02-22T09:25:06.673-05:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2013-02-22T09:19:00.000-05:00

CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a67adb997419fb53540d4a4f79c6471c60bc69b6 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5 MLIST [oss-security] 20130220 Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=913266 CONFIRM https://github.com/torvalds/linux/commit/a67adb997419fb53540d4a4f79c6471c60bc69b6 The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.

cpe:/a:redhat:jboss_enterprise_portal_platform:5.2.2

CVE-2013-0314

2013-04-12T18:55:01.163-04:00

2013-04-15T00:00:00.000-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-04-15T10:02:00.000-04:00

REDHAT RHSA-2013:0613 MISC https://bugzilla.redhat.com/show_bug.cgi?id=913327 The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.

cpe:/a:redhat:jboss_enterprise_portal_platform:5.2.2

CVE-2013-0315

2013-04-12T18:55:01.177-04:00

2013-04-15T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-04-15T10:16:00.000-04:00

REDHAT RHSA-2013:0613 MISC https://bugzilla.redhat.com/show_bug.cgi?id=913340 The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.

CVE-2013-0316

2013-03-27T17:55:02.197-04:00

2013-03-28T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-03-28T10:51:00.000-04:00

CONFIRM http://drupal.org/SA-CORE-2013-002 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.

cpe:/a:joe_haskins:og_manager_change:7.x-2.0 cpe:/a:joe_haskins:og_manager_change:7.x-2.0:beta1 cpe:/a:joe_haskins:og_manager_change:7.x-2.x:dev

CVE-2013-0317

2013-03-27T17:55:02.213-04:00

2013-04-04T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T10:59:00.000-04:00

CONFIRM http://drupal.org/node/1915408 MISC http://drupal.org/node/1916312 CONFIRM http://drupalcode.org/project/og_manager_change.git/commitdiff/ab7152b MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.

cpe:/a:banckle_chat_project:banckle_chat:-

CVE-2013-0318

2013-03-27T17:55:02.230-04:00

2013-03-28T00:00:00.000-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-03-28T11:00:00.000-04:00

MISC http://drupal.org/node/1916370 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.

cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.0 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.1 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.2 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.3 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.4 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.5 cpe:/a:yandex.metrics_project:yandex_metrics:6.x-1.x:dev cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.0 cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.1 cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.2 cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.3 cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.4 cpe:/a:yandex.metrics_project:yandex_metrics:7.x-1.x:dev

CVE-2013-0319

2013-03-27T17:55:02.247-04:00

2013-04-04T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T11:05:00.000-04:00

CONFIRM http://drupal.org/node/1921340 CONFIRM http://drupal.org/node/1921342 MISC http://drupal.org/node/1922400 CONFIRM http://drupalcode.org/project/yandex_metrics.git/commitdiff/290b718 CONFIRM http://drupalcode.org/project/yandex_metrics.git/commitdiff/80bb901 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.

cpe:/a:mattias_hutterer:taxonomy_manager:6.x-2.0 cpe:/a:mattias_hutterer:taxonomy_manager:6.x-2.1 cpe:/a:mattias_hutterer:taxonomy_manager:6.x-2.x:dev cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:alpha1 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:alpha2 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:alpha3 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:alpha4 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:beta1 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:beta2 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.0:beta3 cpe:/a:mattias_hutterer:taxonomy_manager:7.x-1.x:dev

CVE-2013-0320

2013-03-27T17:55:02.263-04:00

2013-03-28T00:00:00.000-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov

2013-03-28T11:17:00.000-04:00

CONFIRM http://drupal.org/node/1922168 CONFIRM http://drupal.org/node/1922170 MISC http://drupal.org/node/1922410 CONFIRM http://drupalcode.org/project/taxonomy_manager.git/commitdiff/2d05801 CONFIRM http://drupalcode.org/project/taxonomy_manager.git/commitdiff/595f1b3 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.

cpe:/a:ubercart_views_project:uc_views:6.x-1.0 cpe:/a:ubercart_views_project:uc_views:6.x-1.1 cpe:/a:ubercart_views_project:uc_views:6.x-1.x:dev cpe:/a:ubercart_views_project:uc_views:6.x-2.0 cpe:/a:ubercart_views_project:uc_views:6.x-3.0 cpe:/a:ubercart_views_project:uc_views:6.x-3.1 cpe:/a:ubercart_views_project:uc_views:6.x-3.2 cpe:/a:ubercart_views_project:uc_views:6.x-3.x:dev

CVE-2013-0321

2013-03-27T17:55:02.283-04:00

2013-03-28T11:28:48.607-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T11:26:00.000-04:00

CONFIRM http://drupal.org/node/1922128 MISC http://drupal.org/node/1922416 CONFIRM http://drupalcode.org/project/uc_views.git/commitdiff/157d5d3 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.

cpe:/a:ubercart:ubercart:7.x-3.0 cpe:/a:ubercart:ubercart:7.x-3.0:alpha1 cpe:/a:ubercart:ubercart:7.x-3.0:alpha2 cpe:/a:ubercart:ubercart:7.x-3.0:alpha3 cpe:/a:ubercart:ubercart:7.x-3.0:beta1 cpe:/a:ubercart:ubercart:7.x-3.0:beta2 cpe:/a:ubercart:ubercart:7.x-3.0:beta3 cpe:/a:ubercart:ubercart:7.x-3.0:beta4 cpe:/a:ubercart:ubercart:7.x-3.0:dev cpe:/a:ubercart:ubercart:7.x-3.0:rc1 cpe:/a:ubercart:ubercart:7.x-3.0:rc2 cpe:/a:ubercart:ubercart:7.x-3.0:rc3 cpe:/a:ubercart:ubercart:7.x-3.0:rc4 cpe:/a:ubercart:ubercart:7.x-3.1 cpe:/a:ubercart:ubercart:7.x-3.2 cpe:/a:ubercart:ubercart:7.x-3.3

CVE-2013-0322

2013-03-27T17:55:02.300-04:00

2013-07-19T23:35:06.773-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://drupal.org/node/1922136 MISC http://drupal.org/node/1922418 CONFIRM http://drupalcode.org/project/ubercart.git/commitdiff/f9d69b5 MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.

cpe:/a:display_suite_project:ds:7.x-1.0 cpe:/a:display_suite_project:ds:7.x-1.0:alpha1 cpe:/a:display_suite_project:ds:7.x-1.0:alpha2 cpe:/a:display_suite_project:ds:7.x-1.0:rc2 cpe:/a:display_suite_project:ds:7.x-1.0:rc3 cpe:/a:display_suite_project:ds:7.x-1.1 cpe:/a:display_suite_project:ds:7.x-1.2 cpe:/a:display_suite_project:ds:7.x-1.3 cpe:/a:display_suite_project:ds:7.x-1.4 cpe:/a:display_suite_project:ds:7.x-1.5 cpe:/a:display_suite_project:ds:7.x-1.6 cpe:/a:display_suite_project:ds:7.x-1.x:dev cpe:/a:display_suite_project:ds:7.x-2.0 cpe:/a:display_suite_project:ds:7.x-2.0:beta1 cpe:/a:display_suite_project:ds:7.x-2.0:beta2 cpe:/a:display_suite_project:ds:7.x-2.0:beta3 cpe:/a:display_suite_project:ds:7.x-2.0:rc1 cpe:/a:display_suite_project:ds:7.x-2.x:dev

CVE-2013-0323

2013-03-27T17:55:02.320-04:00

2013-04-04T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T11:42:00.000-04:00

CONFIRM http://drupal.org/node/1922424 CONFIRM http://drupal.org/node/1922430 MISC http://drupal.org/node/1922438 CONFIRM http://drupalcode.org/project/ds.git/commitdiff/45d490e CONFIRM http://drupalcode.org/project/ds.git/commitdiff/665c791 CONFIRM http://drupalcode.org/project/ds.git/commitdiff/90bcd8f MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.

cpe:/a:tomasbarej:menu_reference:7.x-1.x:dev

CVE-2013-0324

2013-03-27T17:55:02.343-04:00

2013-04-04T00:00:00.000-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T12:01:00.000-04:00

CONFIRM http://drupal.org/node/1922434 MISC http://drupal.org/node/1922446 CONFIRM http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.

cpe:/a:varnish_http_accelerator_integration_project:varnish:6.x-1.0 cpe:/a:varnish_http_accelerator_integration_project:varnish:6.x-1.1 cpe:/a:varnish_http_accelerator_integration_project:varnish:6.x-1.x:dev cpe:/a:varnish_http_accelerator_integration_project:varnish:7.x-1.0:beta1 cpe:/a:varnish_http_accelerator_integration_project:varnish:7.x-1.x:dev

CVE-2013-0325

2013-03-27T17:55:02.847-04:00

2013-03-28T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T12:39:00.000-04:00

CONFIRM http://drupal.org/node/1922726 CONFIRM http://drupal.org/node/1922730 MISC http://drupal.org/node/1922756 CONFIRM http://drupalcode.org/project/varnish.git/commitdiff/e6726b4 CONFIRM http://drupalcode.org/project/varnish.git/commitdiff/f69a62c MLIST [oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.

cpe:/a:jenkins:jenkins:1.480.2::~~lts~~~ cpe:/a:jenkins:jenkins:1.501

CVE-2013-0327

2013-03-19T10:55:02.763-04:00

2016-06-13T11:45:15.397-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-06-13T09:57:40.427-04:00

REDHAT RHSA-2013:0638 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb MLIST [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 MISC https://bugzilla.redhat.com/show_bug.cgi?id=914875 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

cpe:/a:jenkins:jenkins:1.480.2::~~lts~~~ cpe:/a:jenkins:jenkins:1.501

CVE-2013-0328

2013-03-19T10:55:02.787-04:00

2016-06-13T11:47:26.177-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-13T09:59:05.267-04:00

REDHAT RHSA-2013:0638 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb MLIST [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 BID 57994 MISC https://bugzilla.redhat.com/show_bug.cgi?id=914876 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:jenkins:jenkins:1.480.2::~~lts~~~ cpe:/a:jenkins:jenkins:1.501

CVE-2013-0329

2013-03-19T10:55:02.813-04:00

2016-06-13T18:01:05.533-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-13T10:00:00.617-04:00

REDHAT RHSA-2013:0638 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb MLIST [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 MISC https://bugzilla.redhat.com/show_bug.cgi?id=914877 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

cpe:/a:jenkins:jenkins:1.480.2::~~lts~~~ cpe:/a:jenkins:jenkins:1.501

CVE-2013-0330

2013-03-19T10:55:02.833-04:00

2016-06-13T19:24:06.140-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-13T10:01:26.037-04:00

REDHAT RHSA-2013:0638 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb MLIST [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 BID 57994 MISC https://bugzilla.redhat.com/show_bug.cgi?id=914878 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

cpe:/a:jenkins:jenkins:1.480.2::~~lts~~~ cpe:/a:jenkins:jenkins:1.501

CVE-2013-0331

2013-03-19T10:55:02.853-04:00

2016-06-13T19:25:38.357-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2016-06-13T10:02:27.497-04:00

REDHAT RHSA-2013:0638 CONFIRM http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb MLIST [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 BID 57994 MISC https://bugzilla.redhat.com/show_bug.cgi?id=914879 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

cpe:/a:zoneminder:zoneminder:1.24.0 cpe:/a:zoneminder:zoneminder:1.24.1 cpe:/a:zoneminder:zoneminder:1.24.2 cpe:/a:zoneminder:zoneminder:1.24.3

CVE-2013-0332

2013-03-20T11:55:00.937-04:00

2013-03-21T12:31:52.267-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-21T12:30:00.000-04:00

MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700912 DEBIAN DSA-2640 MLIST [oss-security] 20130220 Re: CVE request: zoneminder: local file inclusion vulnerability MLIST [oss-security] 20130221 Re: CVE request: zoneminder: local file inclusion vulnerability CONFIRM http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979 CONFIRM http://www.zoneminder.com/wiki/index.php/Change_History Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.

cpe:/a:rubyonrails:rails:2.3.0 cpe:/a:rubyonrails:rails:2.3.1 cpe:/a:rubyonrails:rails:2.3.2 cpe:/a:rubyonrails:rails:2.3.3 cpe:/a:rubyonrails:rails:2.3.4 cpe:/a:rubyonrails:rails:2.3.9 cpe:/a:rubyonrails:rails:2.3.10 cpe:/a:rubyonrails:rails:2.3.11 cpe:/a:rubyonrails:rails:2.3.12 cpe:/a:rubyonrails:rails:2.3.13 cpe:/a:rubyonrails:rails:2.3.14 cpe:/a:rubyonrails:rails:2.3.15 cpe:/a:rubyonrails:rails:3.0.0 cpe:/a:rubyonrails:rails:3.0.0:beta cpe:/a:rubyonrails:rails:3.0.0:beta2 cpe:/a:rubyonrails:rails:3.0.0:beta3 cpe:/a:rubyonrails:rails:3.0.0:beta4 cpe:/a:rubyonrails:rails:3.0.0:rc cpe:/a:rubyonrails:rails:3.0.0:rc2 cpe:/a:rubyonrails:rails:3.0.1 cpe:/a:rubyonrails:rails:3.0.1:pre cpe:/a:rubyonrails:rails:3.0.2 cpe:/a:rubyonrails:rails:3.0.2:pre cpe:/a:rubyonrails:rails:3.0.3 cpe:/a:rubyonrails:rails:3.0.4:rc1 cpe:/a:rubyonrails:rails:3.0.5 cpe:/a:rubyonrails:rails:3.0.5:rc1 cpe:/a:rubyonrails:rails:3.0.6 cpe:/a:rubyonrails:rails:3.0.6:rc1 cpe:/a:rubyonrails:rails:3.0.6:rc2 cpe:/a:rubyonrails:rails:3.0.7 cpe:/a:rubyonrails:rails:3.0.7:rc1 cpe:/a:rubyonrails:rails:3.0.7:rc2 cpe:/a:rubyonrails:rails:3.0.8 cpe:/a:rubyonrails:rails:3.0.8:rc1 cpe:/a:rubyonrails:rails:3.0.8:rc2 cpe:/a:rubyonrails:rails:3.0.8:rc3 cpe:/a:rubyonrails:rails:3.0.8:rc4 cpe:/a:rubyonrails:rails:3.0.9 cpe:/a:rubyonrails:rails:3.0.9:rc1 cpe:/a:rubyonrails:rails:3.0.9:rc2 cpe:/a:rubyonrails:rails:3.0.9:rc3 cpe:/a:rubyonrails:rails:3.0.9:rc4 cpe:/a:rubyonrails:rails:3.0.9:rc5 cpe:/a:rubyonrails:rails:3.0.10 cpe:/a:rubyonrails:rails:3.0.10:rc1 cpe:/a:rubyonrails:rails:3.0.11 cpe:/a:rubyonrails:rails:3.0.12 cpe:/a:rubyonrails:rails:3.0.12:rc1 cpe:/a:rubyonrails:rails:3.0.13 cpe:/a:rubyonrails:rails:3.0.13:rc1 cpe:/a:rubyonrails:rails:3.0.14 cpe:/a:rubyonrails:rails:3.0.16 cpe:/a:rubyonrails:rails:3.0.17 cpe:/a:rubyonrails:rails:3.0.18 cpe:/a:rubyonrails:rails:3.0.19 cpe:/a:rubyonrails:ruby_on_rails:3.0.4

CVE-2013-0333

2013-01-30T07:00:08.930-05:00

2019-08-08T11:42:27.043-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov APPLE APPLE-SA-2013-06-04-1 APPLE APPLE-SA-2013-03-14-1 REDHAT RHSA-2013:0201 REDHAT RHSA-2013:0202 REDHAT RHSA-2013:0203 CONFIRM http://support.apple.com/kb/HT5784 CONFIRM http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/ DEBIAN DSA-2613 CERT-VN VU#628463 MLIST [rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 CONFIRM https://puppet.com/security/cve/cve-2013-0333 lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

cpe:/a:bundler:bundler:0.3.1::~~~ruby~~ cpe:/a:bundler:bundler:0.4.0::~~~ruby~~ cpe:/a:bundler:bundler:0.4.1::~~~ruby~~ cpe:/a:bundler:bundler:0.5.0::~~~ruby~~ cpe:/a:bundler:bundler:0.6.0::~~~ruby~~ cpe:/a:bundler:bundler:0.7.0::~~~ruby~~ cpe:/a:bundler:bundler:0.7.2::~~~ruby~~ cpe:/a:bundler:bundler:0.8.0::~~~ruby~~ cpe:/a:bundler:bundler:0.8.2::~~~ruby~~ cpe:/a:bundler:bundler:0.8.5::~~~ruby~~ cpe:/a:bundler:bundler:0.9.0:-:~~~ruby~~ cpe:/a:bundler:bundler:0.9.0:pre3:~~~ruby~~ cpe:/a:bundler:bundler:0.9.0:pre4:~~~ruby~~ cpe:/a:bundler:bundler:0.9.0:pre5:~~~ruby~~ cpe:/a:bundler:bundler:0.9.2::~~~ruby~~ cpe:/a:bundler:bundler:0.9.3::~~~ruby~~ cpe:/a:bundler:bundler:0.9.4::~~~ruby~~ cpe:/a:bundler:bundler:0.9.5::~~~ruby~~ cpe:/a:bundler:bundler:0.9.6::~~~ruby~~ cpe:/a:bundler:bundler:0.9.7::~~~ruby~~ cpe:/a:bundler:bundler:0.9.8::~~~ruby~~ cpe:/a:bundler:bundler:0.9.9::~~~ruby~~ cpe:/a:bundler:bundler:0.9.10::~~~ruby~~ cpe:/a:bundler:bundler:0.9.11::~~~ruby~~ cpe:/a:bundler:bundler:0.9.12::~~~ruby~~ cpe:/a:bundler:bundler:0.9.13::~~~ruby~~ cpe:/a:bundler:bundler:0.9.14::~~~ruby~~ cpe:/a:bundler:bundler:0.9.15::~~~ruby~~ cpe:/a:bundler:bundler:0.9.16::~~~ruby~~ cpe:/a:bundler:bundler:0.9.17::~~~ruby~~ cpe:/a:bundler:bundler:0.9.18::~~~ruby~~ cpe:/a:bundler:bundler:0.9.19::~~~ruby~~ cpe:/a:bundler:bundler:0.9.20::~~~ruby~~ cpe:/a:bundler:bundler:0.9.21::~~~ruby~~ cpe:/a:bundler:bundler:0.9.22::~~~ruby~~ cpe:/a:bundler:bundler:0.9.23::~~~ruby~~ cpe:/a:bundler:bundler:0.9.24::~~~ruby~~ cpe:/a:bundler:bundler:0.9.25::~~~ruby~~ cpe:/a:bundler:bundler:0.9.26::~~~ruby~~ cpe:/a:bundler:bundler:1.0.0::~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta1:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta10:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta2:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta3:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta4:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta5:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta6:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta7:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta8:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:beta9:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc1:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc2:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc3:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc4:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc5:~~~ruby~~ cpe:/a:bundler:bundler:1.0.0:rc6:~~~ruby~~ cpe:/a:bundler:bundler:1.0.1::~~~ruby~~ cpe:/a:bundler:bundler:1.0.2::~~~ruby~~ cpe:/a:bundler:bundler:1.0.3::~~~ruby~~ cpe:/a:bundler:bundler:1.0.4::~~~ruby~~ cpe:/a:bundler:bundler:1.0.5::~~~ruby~~ cpe:/a:bundler:bundler:1.0.6::~~~ruby~~ cpe:/a:bundler:bundler:1.0.7::~~~ruby~~ cpe:/a:bundler:bundler:1.0.8::~~~ruby~~ cpe:/a:bundler:bundler:1.0.9::~~~ruby~~ cpe:/a:bundler:bundler:1.0.10::~~~ruby~~ cpe:/a:bundler:bundler:1.0.11::~~~ruby~~ cpe:/a:bundler:bundler:1.0.12::~~~ruby~~ cpe:/a:bundler:bundler:1.0.13::~~~ruby~~ cpe:/a:bundler:bundler:1.0.14::~~~ruby~~ cpe:/a:bundler:bundler:1.0.15::~~~ruby~~ cpe:/a:bundler:bundler:1.0.16::~~~ruby~~ cpe:/a:bundler:bundler:1.0.17::~~~ruby~~ cpe:/a:bundler:bundler:1.0.18::~~~ruby~~ cpe:/a:bundler:bundler:1.0.19:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.0.20::~~~ruby~~ cpe:/a:bundler:bundler:1.0.20:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.0.21::~~~ruby~~ cpe:/a:bundler:bundler:1.0.21:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.0.21.1::~~~ruby~~ cpe:/a:bundler:bundler:1.0.22::~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre1:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre10:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre2:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre3:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre4:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre5:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre6:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre7:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre8:~~~ruby~~ cpe:/a:bundler:bundler:1.1:pre9:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc2:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc3:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc4:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc5:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc6:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc7:~~~ruby~~ cpe:/a:bundler:bundler:1.1:rc8:~~~ruby~~ cpe:/a:bundler:bundler:1.1.0::~~~ruby~~ cpe:/a:bundler:bundler:1.1.1::~~~ruby~~ cpe:/a:bundler:bundler:1.1.2::~~~ruby~~ cpe:/a:bundler:bundler:1.1.3::~~~ruby~~ cpe:/a:bundler:bundler:1.1.4::~~~ruby~~ cpe:/a:bundler:bundler:1.1.5::~~~ruby~~ cpe:/a:bundler:bundler:1.2.0::~~~ruby~~ cpe:/a:bundler:bundler:1.2.0:pre:~~~ruby~~ cpe:/a:bundler:bundler:1.2.0:pre1:~~~ruby~~ cpe:/a:bundler:bundler:1.2.0:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.2.0:rc2:~~~ruby~~ cpe:/a:bundler:bundler:1.2.1::~~~ruby~~ cpe:/a:bundler:bundler:1.2.2::~~~ruby~~ cpe:/a:bundler:bundler:1.2.3::~~~ruby~~ cpe:/a:bundler:bundler:1.2.4::~~~ruby~~ cpe:/a:bundler:bundler:1.2.5::~~~ruby~~ cpe:/a:bundler:bundler:1.3.0::~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre2:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre3:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre4:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre5:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre6:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre7:~~~ruby~~ cpe:/a:bundler:bundler:1.3.0:pre8:~~~ruby~~ cpe:/a:bundler:bundler:1.3.1::~~~ruby~~ cpe:/a:bundler:bundler:1.3.2::~~~ruby~~ cpe:/a:bundler:bundler:1.3.3::~~~ruby~~ cpe:/a:bundler:bundler:1.3.4::~~~ruby~~ cpe:/a:bundler:bundler:1.3.5::~~~ruby~~ cpe:/a:bundler:bundler:1.3.6::~~~ruby~~ cpe:/a:bundler:bundler:1.4.0:pre1:~~~ruby~~ cpe:/a:bundler:bundler:1.4.0:pre2:~~~ruby~~ cpe:/a:bundler:bundler:1.4.0:rc1:~~~ruby~~ cpe:/a:bundler:bundler:1.5.0::~~~ruby~~ cpe:/a:bundler:bundler:1.5.0:rc1:~~~ruby~~ cpe:/a:bundler:bundler:1.5.0:rc2:~~~ruby~~ cpe:/a:bundler:bundler:1.5.1::~~~ruby~~ cpe:/a:bundler:bundler:1.5.2::~~~ruby~~ cpe:/a:bundler:bundler:1.5.3::~~~ruby~~ cpe:/a:bundler:bundler:1.6:-:~~~ruby~~ cpe:/a:bundler:bundler:1.6.0::~~~ruby~~ cpe:/a:bundler:bundler:1.6.0:pre1:~~~ruby~~ cpe:/a:bundler:bundler:1.6.0:pre2:~~~ruby~~ cpe:/a:bundler:bundler:1.6.0:rc:~~~ruby~~ cpe:/a:bundler:bundler:1.6.0:rc2:~~~ruby~~ cpe:/a:bundler:bundler:1.6.1::~~~ruby~~ cpe:/a:bundler:bundler:1.6.2::~~~ruby~~ cpe:/a:bundler:bundler:1.6.3::~~~ruby~~ cpe:/a:bundler:bundler:1.6.4::~~~ruby~~ cpe:/a:bundler:bundler:1.6.5::~~~ruby~~ cpe:/a:bundler:bundler:1.6.6::~~~ruby~~ cpe:/a:bundler:bundler:1.6.7::~~~ruby~~ cpe:/a:bundler:bundler:1.6.8::~~~ruby~~ cpe:/a:bundler:bundler:1.6.9::~~~ruby~~ cpe:/o:fedoraproject:fedora:19 cpe:/o:fedoraproject:fedora:20 cpe:/o:fedoraproject:fedora:21 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2

CVE-2013-0334

2014-10-31T10:55:02.687-04:00

2019-07-16T08:21:06.373-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-02T11:01:39.783-04:00

CONFIRM http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html FEDORA FEDORA-2014-11649 FEDORA FEDORA-2014-11630 FEDORA FEDORA-2014-11677 SUSE openSUSE-SU-2015:0628 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html BID 70099 GENTOO GLSA-201609-02 Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

cpe:/a:openstack:essex:2012.1 cpe:/a:openstack:folsom:2012.2 cpe:/a:openstack:grizzly:2012.2 cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10

CVE-2013-0335

2013-03-22T17:55:00.880-04:00

2013-06-04T23:40:45.060-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0709 MLIST [oss-security] 20130226 [OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335) UBUNTU USN-1771-1 CONFIRM https://bugs.launchpad.net/nova/+bug/1125378 CONFIRM https://review.openstack.org/#/c/22086/ CONFIRM https://review.openstack.org/#/c/22758 CONFIRM https://review.openstack.org/#/c/22872/ OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

cpe:/a:redhat:freeipa:3.0.0 cpe:/a:redhat:freeipa:3.0.1 cpe:/a:redhat:freeipa:3.0.2 cpe:/a:redhat:freeipa:3.1.1 cpe:/a:redhat:freeipa:3.1.2 cpe:/a:redhat:freeipa:3.1.3 cpe:/a:redhat:freeipa:3.1.4 cpe:/a:redhat:freeipa:3.1.5

CVE-2013-0336

2014-11-03T18:55:04.877-05:00

2017-08-28T21:33:01.387-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 58747 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=913751 XF 389directoryserver-cve20130336-dos(83132) CONFIRM https://fedorahosted.org/freeipa/ticket/3539 CONFIRM https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=7b45e33400355df44e75576ef7f70a39d163bf8e The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.

cpe:/a:nginx:nginx:1.0.0 cpe:/a:nginx:nginx:1.0.1 cpe:/a:nginx:nginx:1.0.2 cpe:/a:nginx:nginx:1.0.3 cpe:/a:nginx:nginx:1.0.4 cpe:/a:nginx:nginx:1.0.5 cpe:/a:nginx:nginx:1.0.6 cpe:/a:nginx:nginx:1.0.7 cpe:/a:nginx:nginx:1.0.8 cpe:/a:nginx:nginx:1.0.9 cpe:/a:nginx:nginx:1.0.10 cpe:/a:nginx:nginx:1.0.11 cpe:/a:nginx:nginx:1.0.12 cpe:/a:nginx:nginx:1.0.13 cpe:/a:nginx:nginx:1.0.14 cpe:/a:nginx:nginx:1.0.15 cpe:/a:nginx:nginx:1.1.0 cpe:/a:nginx:nginx:1.1.1 cpe:/a:nginx:nginx:1.1.2 cpe:/a:nginx:nginx:1.1.3 cpe:/a:nginx:nginx:1.1.4 cpe:/a:nginx:nginx:1.1.5 cpe:/a:nginx:nginx:1.1.6 cpe:/a:nginx:nginx:1.1.7 cpe:/a:nginx:nginx:1.1.8 cpe:/a:nginx:nginx:1.1.9 cpe:/a:nginx:nginx:1.1.10 cpe:/a:nginx:nginx:1.1.11 cpe:/a:nginx:nginx:1.1.12 cpe:/a:nginx:nginx:1.1.13 cpe:/a:nginx:nginx:1.1.14 cpe:/a:nginx:nginx:1.1.15 cpe:/a:nginx:nginx:1.1.16 cpe:/a:nginx:nginx:1.1.17 cpe:/a:nginx:nginx:1.1.18 cpe:/a:nginx:nginx:1.1.19 cpe:/a:nginx:nginx:1.2.0 cpe:/a:nginx:nginx:1.3.0 cpe:/a:nginx:nginx:1.3.1 cpe:/a:nginx:nginx:1.3.2 cpe:/a:nginx:nginx:1.3.3 cpe:/a:nginx:nginx:1.3.4 cpe:/a:nginx:nginx:1.3.5 cpe:/a:nginx:nginx:1.3.6 cpe:/a:nginx:nginx:1.3.7 cpe:/a:nginx:nginx:1.3.8 cpe:/a:nginx:nginx:1.3.9 cpe:/a:nginx:nginx:1.3.10 cpe:/a:nginx:nginx:1.3.11 cpe:/a:nginx:nginx:1.3.12 cpe:/a:nginx:nginx:1.3.13

CVE-2013-0337

2013-10-26T20:55:03.713-04:00

2019-02-28T15:51:54.153-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-10-28T14:15:23.670-04:00

GENTOO GLSA-201310-04 MLIST [oss-security] 20130221 nginx world-readable logdir MLIST [oss-security] 20130221 Re: CVE request: nginx world-readable logdir MLIST [oss-security] 20130224 nginx CVE-2013-0337 world-readable logs The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.

cpe:/a:xmlsoft:libxml2:1.7.0 cpe:/a:xmlsoft:libxml2:1.7.1 cpe:/a:xmlsoft:libxml2:1.7.2 cpe:/a:xmlsoft:libxml2:1.7.3 cpe:/a:xmlsoft:libxml2:1.7.4 cpe:/a:xmlsoft:libxml2:1.8.0 cpe:/a:xmlsoft:libxml2:1.8.1 cpe:/a:xmlsoft:libxml2:1.8.2 cpe:/a:xmlsoft:libxml2:1.8.3 cpe:/a:xmlsoft:libxml2:1.8.4 cpe:/a:xmlsoft:libxml2:1.8.5 cpe:/a:xmlsoft:libxml2:1.8.6 cpe:/a:xmlsoft:libxml2:1.8.7 cpe:/a:xmlsoft:libxml2:1.8.9 cpe:/a:xmlsoft:libxml2:1.8.10 cpe:/a:xmlsoft:libxml2:1.8.13 cpe:/a:xmlsoft:libxml2:1.8.14 cpe:/a:xmlsoft:libxml2:1.8.16 cpe:/a:xmlsoft:libxml2:2.0.0 cpe:/a:xmlsoft:libxml2:2.1.0 cpe:/a:xmlsoft:libxml2:2.1.1 cpe:/a:xmlsoft:libxml2:2.2.0 cpe:/a:xmlsoft:libxml2:2.2.0:beta cpe:/a:xmlsoft:libxml2:2.2.1 cpe:/a:xmlsoft:libxml2:2.2.2 cpe:/a:xmlsoft:libxml2:2.2.3 cpe:/a:xmlsoft:libxml2:2.2.4 cpe:/a:xmlsoft:libxml2:2.2.5 cpe:/a:xmlsoft:libxml2:2.2.6 cpe:/a:xmlsoft:libxml2:2.2.7 cpe:/a:xmlsoft:libxml2:2.2.8 cpe:/a:xmlsoft:libxml2:2.2.9 cpe:/a:xmlsoft:libxml2:2.2.10 cpe:/a:xmlsoft:libxml2:2.2.11 cpe:/a:xmlsoft:libxml2:2.3.0 cpe:/a:xmlsoft:libxml2:2.3.1 cpe:/a:xmlsoft:libxml2:2.3.2 cpe:/a:xmlsoft:libxml2:2.3.3 cpe:/a:xmlsoft:libxml2:2.3.4 cpe:/a:xmlsoft:libxml2:2.3.5 cpe:/a:xmlsoft:libxml2:2.3.6 cpe:/a:xmlsoft:libxml2:2.3.7 cpe:/a:xmlsoft:libxml2:2.3.8 cpe:/a:xmlsoft:libxml2:2.3.9 cpe:/a:xmlsoft:libxml2:2.3.10 cpe:/a:xmlsoft:libxml2:2.3.11 cpe:/a:xmlsoft:libxml2:2.3.12 cpe:/a:xmlsoft:libxml2:2.3.13 cpe:/a:xmlsoft:libxml2:2.3.14 cpe:/a:xmlsoft:libxml2:2.4.1 cpe:/a:xmlsoft:libxml2:2.4.2 cpe:/a:xmlsoft:libxml2:2.4.3 cpe:/a:xmlsoft:libxml2:2.4.4 cpe:/a:xmlsoft:libxml2:2.4.5 cpe:/a:xmlsoft:libxml2:2.4.6 cpe:/a:xmlsoft:libxml2:2.4.7 cpe:/a:xmlsoft:libxml2:2.4.8 cpe:/a:xmlsoft:libxml2:2.4.9 cpe:/a:xmlsoft:libxml2:2.4.10 cpe:/a:xmlsoft:libxml2:2.4.11 cpe:/a:xmlsoft:libxml2:2.4.12 cpe:/a:xmlsoft:libxml2:2.4.13 cpe:/a:xmlsoft:libxml2:2.4.14 cpe:/a:xmlsoft:libxml2:2.4.15 cpe:/a:xmlsoft:libxml2:2.4.16 cpe:/a:xmlsoft:libxml2:2.4.17 cpe:/a:xmlsoft:libxml2:2.4.18 cpe:/a:xmlsoft:libxml2:2.4.19 cpe:/a:xmlsoft:libxml2:2.4.20 cpe:/a:xmlsoft:libxml2:2.4.21 cpe:/a:xmlsoft:libxml2:2.4.22 cpe:/a:xmlsoft:libxml2:2.4.23 cpe:/a:xmlsoft:libxml2:2.4.24 cpe:/a:xmlsoft:libxml2:2.4.25 cpe:/a:xmlsoft:libxml2:2.4.26 cpe:/a:xmlsoft:libxml2:2.4.27 cpe:/a:xmlsoft:libxml2:2.4.28 cpe:/a:xmlsoft:libxml2:2.4.29 cpe:/a:xmlsoft:libxml2:2.4.30 cpe:/a:xmlsoft:libxml2:2.5.0 cpe:/a:xmlsoft:libxml2:2.5.4 cpe:/a:xmlsoft:libxml2:2.5.7 cpe:/a:xmlsoft:libxml2:2.5.8 cpe:/a:xmlsoft:libxml2:2.5.10 cpe:/a:xmlsoft:libxml2:2.5.11 cpe:/a:xmlsoft:libxml2:2.6.0 cpe:/a:xmlsoft:libxml2:2.6.1 cpe:/a:xmlsoft:libxml2:2.6.2 cpe:/a:xmlsoft:libxml2:2.6.3 cpe:/a:xmlsoft:libxml2:2.6.4 cpe:/a:xmlsoft:libxml2:2.6.5 cpe:/a:xmlsoft:libxml2:2.6.6 cpe:/a:xmlsoft:libxml2:2.6.7 cpe:/a:xmlsoft:libxml2:2.6.8 cpe:/a:xmlsoft:libxml2:2.6.9 cpe:/a:xmlsoft:libxml2:2.6.11 cpe:/a:xmlsoft:libxml2:2.6.12 cpe:/a:xmlsoft:libxml2:2.6.13 cpe:/a:xmlsoft:libxml2:2.6.14 cpe:/a:xmlsoft:libxml2:2.6.16 cpe:/a:xmlsoft:libxml2:2.6.17 cpe:/a:xmlsoft:libxml2:2.6.18 cpe:/a:xmlsoft:libxml2:2.6.20 cpe:/a:xmlsoft:libxml2:2.6.21 cpe:/a:xmlsoft:libxml2:2.6.22 cpe:/a:xmlsoft:libxml2:2.6.23 cpe:/a:xmlsoft:libxml2:2.6.24 cpe:/a:xmlsoft:libxml2:2.6.25 cpe:/a:xmlsoft:libxml2:2.6.26 cpe:/a:xmlsoft:libxml2:2.6.27 cpe:/a:xmlsoft:libxml2:2.6.28 cpe:/a:xmlsoft:libxml2:2.6.29 cpe:/a:xmlsoft:libxml2:2.6.30 cpe:/a:xmlsoft:libxml2:2.6.31 cpe:/a:xmlsoft:libxml2:2.6.32 cpe:/a:xmlsoft:libxml2:2.7.0 cpe:/a:xmlsoft:libxml2:2.7.1 cpe:/a:xmlsoft:libxml2:2.7.2 cpe:/a:xmlsoft:libxml2:2.7.3 cpe:/a:xmlsoft:libxml2:2.7.4 cpe:/a:xmlsoft:libxml2:2.7.5 cpe:/a:xmlsoft:libxml2:2.7.6 cpe:/a:xmlsoft:libxml2:2.7.7 cpe:/a:xmlsoft:libxml2:2.7.8 cpe:/a:xmlsoft:libxml2:2.9.0 cpe:/a:xmlsoft:libxml2:2.9.0:rc1 cpe:/o:canonical:ubuntu_linux:8.04:-:lts cpe:/o:canonical:ubuntu_linux:10.04:-:lts cpe:/o:canonical:ubuntu_linux:11.10 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2 cpe:/o:opensuse:opensuse:12.3

CVE-2013-0338

2013-04-25T19:55:01.500-04:00

2018-10-30T12:27:34.373-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2013:1627 SUSE openSUSE-SU-2013:0552 SUSE openSUSE-SU-2013:0555 HP SSRT101996 DEBIAN DSA-2652 MANDRIVA MDVSA-2013:056 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html UBUNTU USN-1782-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=912400 CONFIRM https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.

cpe:/a:xmlsoft:libxml2:1.7.0 cpe:/a:xmlsoft:libxml2:1.7.1 cpe:/a:xmlsoft:libxml2:1.7.2 cpe:/a:xmlsoft:libxml2:1.7.3 cpe:/a:xmlsoft:libxml2:1.7.4 cpe:/a:xmlsoft:libxml2:1.8.0 cpe:/a:xmlsoft:libxml2:1.8.1 cpe:/a:xmlsoft:libxml2:1.8.2 cpe:/a:xmlsoft:libxml2:1.8.3 cpe:/a:xmlsoft:libxml2:1.8.4 cpe:/a:xmlsoft:libxml2:1.8.5 cpe:/a:xmlsoft:libxml2:1.8.6 cpe:/a:xmlsoft:libxml2:1.8.7 cpe:/a:xmlsoft:libxml2:1.8.9 cpe:/a:xmlsoft:libxml2:1.8.10 cpe:/a:xmlsoft:libxml2:1.8.13 cpe:/a:xmlsoft:libxml2:1.8.14 cpe:/a:xmlsoft:libxml2:1.8.16 cpe:/a:xmlsoft:libxml2:2.0.0 cpe:/a:xmlsoft:libxml2:2.1.0 cpe:/a:xmlsoft:libxml2:2.1.1 cpe:/a:xmlsoft:libxml2:2.2.0 cpe:/a:xmlsoft:libxml2:2.2.0:beta cpe:/a:xmlsoft:libxml2:2.2.1 cpe:/a:xmlsoft:libxml2:2.2.2 cpe:/a:xmlsoft:libxml2:2.2.3 cpe:/a:xmlsoft:libxml2:2.2.4 cpe:/a:xmlsoft:libxml2:2.2.5 cpe:/a:xmlsoft:libxml2:2.2.6 cpe:/a:xmlsoft:libxml2:2.2.7 cpe:/a:xmlsoft:libxml2:2.2.8 cpe:/a:xmlsoft:libxml2:2.2.9 cpe:/a:xmlsoft:libxml2:2.2.10 cpe:/a:xmlsoft:libxml2:2.2.11 cpe:/a:xmlsoft:libxml2:2.3.0 cpe:/a:xmlsoft:libxml2:2.3.1 cpe:/a:xmlsoft:libxml2:2.3.2 cpe:/a:xmlsoft:libxml2:2.3.3 cpe:/a:xmlsoft:libxml2:2.3.4 cpe:/a:xmlsoft:libxml2:2.3.5 cpe:/a:xmlsoft:libxml2:2.3.6 cpe:/a:xmlsoft:libxml2:2.3.7 cpe:/a:xmlsoft:libxml2:2.3.8 cpe:/a:xmlsoft:libxml2:2.3.9 cpe:/a:xmlsoft:libxml2:2.3.10 cpe:/a:xmlsoft:libxml2:2.3.11 cpe:/a:xmlsoft:libxml2:2.3.12 cpe:/a:xmlsoft:libxml2:2.3.13 cpe:/a:xmlsoft:libxml2:2.3.14 cpe:/a:xmlsoft:libxml2:2.4.1 cpe:/a:xmlsoft:libxml2:2.4.2 cpe:/a:xmlsoft:libxml2:2.4.3 cpe:/a:xmlsoft:libxml2:2.4.4 cpe:/a:xmlsoft:libxml2:2.4.5 cpe:/a:xmlsoft:libxml2:2.4.6 cpe:/a:xmlsoft:libxml2:2.4.7 cpe:/a:xmlsoft:libxml2:2.4.8 cpe:/a:xmlsoft:libxml2:2.4.9 cpe:/a:xmlsoft:libxml2:2.4.10 cpe:/a:xmlsoft:libxml2:2.4.11 cpe:/a:xmlsoft:libxml2:2.4.12 cpe:/a:xmlsoft:libxml2:2.4.13 cpe:/a:xmlsoft:libxml2:2.4.14 cpe:/a:xmlsoft:libxml2:2.4.15 cpe:/a:xmlsoft:libxml2:2.4.16 cpe:/a:xmlsoft:libxml2:2.4.17 cpe:/a:xmlsoft:libxml2:2.4.18 cpe:/a:xmlsoft:libxml2:2.4.19 cpe:/a:xmlsoft:libxml2:2.4.20 cpe:/a:xmlsoft:libxml2:2.4.21 cpe:/a:xmlsoft:libxml2:2.4.22 cpe:/a:xmlsoft:libxml2:2.4.23 cpe:/a:xmlsoft:libxml2:2.4.24 cpe:/a:xmlsoft:libxml2:2.4.25 cpe:/a:xmlsoft:libxml2:2.4.26 cpe:/a:xmlsoft:libxml2:2.4.27 cpe:/a:xmlsoft:libxml2:2.4.28 cpe:/a:xmlsoft:libxml2:2.4.29 cpe:/a:xmlsoft:libxml2:2.4.30 cpe:/a:xmlsoft:libxml2:2.5.0 cpe:/a:xmlsoft:libxml2:2.5.4 cpe:/a:xmlsoft:libxml2:2.5.7 cpe:/a:xmlsoft:libxml2:2.5.8 cpe:/a:xmlsoft:libxml2:2.5.10 cpe:/a:xmlsoft:libxml2:2.5.11 cpe:/a:xmlsoft:libxml2:2.6.0 cpe:/a:xmlsoft:libxml2:2.6.1 cpe:/a:xmlsoft:libxml2:2.6.2 cpe:/a:xmlsoft:libxml2:2.6.3 cpe:/a:xmlsoft:libxml2:2.6.4 cpe:/a:xmlsoft:libxml2:2.6.5 cpe:/a:xmlsoft:libxml2:2.6.6 cpe:/a:xmlsoft:libxml2:2.6.7 cpe:/a:xmlsoft:libxml2:2.6.8 cpe:/a:xmlsoft:libxml2:2.6.9 cpe:/a:xmlsoft:libxml2:2.6.11 cpe:/a:xmlsoft:libxml2:2.6.12 cpe:/a:xmlsoft:libxml2:2.6.13 cpe:/a:xmlsoft:libxml2:2.6.14 cpe:/a:xmlsoft:libxml2:2.6.16 cpe:/a:xmlsoft:libxml2:2.6.17 cpe:/a:xmlsoft:libxml2:2.6.18 cpe:/a:xmlsoft:libxml2:2.6.20 cpe:/a:xmlsoft:libxml2:2.6.21 cpe:/a:xmlsoft:libxml2:2.6.22 cpe:/a:xmlsoft:libxml2:2.6.23 cpe:/a:xmlsoft:libxml2:2.6.24 cpe:/a:xmlsoft:libxml2:2.6.25 cpe:/a:xmlsoft:libxml2:2.6.26 cpe:/a:xmlsoft:libxml2:2.6.27 cpe:/a:xmlsoft:libxml2:2.6.28 cpe:/a:xmlsoft:libxml2:2.6.29 cpe:/a:xmlsoft:libxml2:2.6.30 cpe:/a:xmlsoft:libxml2:2.6.31 cpe:/a:xmlsoft:libxml2:2.6.32 cpe:/a:xmlsoft:libxml2:2.7.0 cpe:/a:xmlsoft:libxml2:2.7.1 cpe:/a:xmlsoft:libxml2:2.7.2 cpe:/a:xmlsoft:libxml2:2.7.3 cpe:/a:xmlsoft:libxml2:2.7.4 cpe:/a:xmlsoft:libxml2:2.7.5 cpe:/a:xmlsoft:libxml2:2.7.6 cpe:/a:xmlsoft:libxml2:2.7.7 cpe:/a:xmlsoft:libxml2:2.7.8 cpe:/a:xmlsoft:libxml2:2.8.0 cpe:/a:xmlsoft:libxml2:2.9.0 cpe:/a:xmlsoft:libxml2:2.9.0:rc1 cpe:/a:xmlsoft:libxml2:2.9.1 cpe:/o:canonical:ubuntu_linux:10.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:12.10 cpe:/o:canonical:ubuntu_linux:13.04 cpe:/o:debian:debian_linux:6.0 cpe:/o:debian:debian_linux:7.0 cpe:/o:suse:linux_enterprise_server:10:sp4:~~ltss~~~

CVE-2013-0339

2014-01-21T13:55:09.053-05:00

2016-05-05T11:29:20.087-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2014-01-22T15:31:42.350-05:00

SUSE SUSE-SU-2013:1627 MLIST [oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS MLIST [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion MLIST [oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue MLIST [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue MLIST [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue DEBIAN DSA-2652 MLIST [oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments UBUNTU USN-1904-1 UBUNTU USN-1904-2 MISC https://bugzilla.redhat.com/show_bug.cgi?id=915149 MISC https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

cpe:/a:libexpat:expat:1.95.1 cpe:/a:libexpat:expat:1.95.2 cpe:/a:libexpat:expat:1.95.4 cpe:/a:libexpat:expat:1.95.5 cpe:/a:libexpat:expat:1.95.6 cpe:/a:libexpat:expat:1.95.7 cpe:/a:libexpat:expat:1.95.8 cpe:/a:libexpat:expat:2.0.0 cpe:/a:libexpat:expat:2.0.1 cpe:/a:libexpat:expat:2.1.0

CVE-2013-0340

2014-01-21T13:55:09.117-05:00

2017-06-30T21:29:03.950-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion SECTRACK 1028213 MLIST [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments BID 58233 GENTOO GLSA-201701-21 expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

CVE-2013-0341

2013-09-26T10:16:22.077-04:00

2013-09-26T10:16:22.483-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5 cpe:/o:linux:linux_kernel:3.7.6 cpe:/o:linux:linux_kernel:3.7.7 cpe:/o:linux:linux_kernel:3.7.8 cpe:/o:linux:linux_kernel:3.7.9 cpe:/o:linux:linux_kernel:3.7.10 cpe:/o:linux:linux_kernel:3.8

CVE-2013-0343

2013-02-28T14:55:01.230-05:00

2014-03-05T23:42:55.320-05:00

3.2

ADJACENT_NETWORK

HIGH

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2014:0204 MLIST [oss-security] 20121205 Re: Linux kernel handling of IPv6 temporary addresses MLIST [oss-security] 20130116 Re: Linux kernel handling of IPv6 temporary addresses MLIST [oss-security] 20130121 Re: Linux kernel handling of IPv6 temporary addresses REDHAT RHSA-2013:1449 REDHAT RHSA-2013:1490 REDHAT RHSA-2013:1645 MLIST [oss-security] 20130222 Re: Linux kernel handling of IPv6 temporary addresses UBUNTU USN-1976-1 UBUNTU USN-1977-1 UBUNTU USN-2019-1 UBUNTU USN-2020-1 UBUNTU USN-2021-1 UBUNTU USN-2022-1 UBUNTU USN-2023-1 UBUNTU USN-2024-1 UBUNTU USN-2038-1 UBUNTU USN-2039-1 UBUNTU USN-2050-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=914664 The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.

cpe:/a:varnish-cache:varnish:3.0.3

CVE-2013-0345

2014-05-08T10:29:08.237-04:00

2014-05-08T10:49:25.677-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-05-08T10:45:50.463-04:00

MLIST [oss-security] 20130222 CVE request: varnish world-readable logdir MLIST [oss-security] 20130222 Re: CVE request: varnish world-readable logdir BID 58125 varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information.

cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50

CVE-2013-0346

2014-02-15T09:57:07.613-05:00

2014-02-18T14:40:25.777-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-02-18T14:39:58.213-05:00

MLIST [oss-security] 20130222 Re: Cve request: tomcat world-readable logdir MISC https://bugzilla.redhat.com/show_bug.cgi?id=924841 ** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

cpe:/a:webfs:webfs:-

CVE-2013-0347

2014-11-16T06:59:00.120-05:00

2017-08-28T21:33:01.447-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MLIST [oss-security] 20130222 CVE request: webfs world-readable log MLIST [oss-security] 20130222 Re: CVE request: webfs world-readable log MLIST [oss-security] 20130222 Re: Re: CVE request: webfs world-readable log BID 58126 XF webfs-webfsd-information-disclosure(82356) The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.

cpe:/a:acme:thttpd:2.25:b cpe:/a:open_source_development_team:sthttpd:2.26 cpe:/a:open_source_development_team:sthttpd:2.26.1 cpe:/a:open_source_development_team:sthttpd:2.26.2 cpe:/a:open_source_development_team:sthttpd:2.26.3 cpe:/a:open_source_development_team:sthttpd:2.26.4 cpe:/o:fedoraproject:fedora:17 cpe:/o:fedoraproject:fedora:18 cpe:/o:gentoo:linux cpe:/o:opensuse:opensuse:12.2 cpe:/o:opensuse:opensuse:12.3 cpe:/o:opensuse:opensuse:13.1

CVE-2013-0348

2013-12-13T13:07:54.030-05:00

2018-10-30T12:27:34.687-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2013:1862 SUSE openSUSE-SU-2014:0021 CONFIRM http://opensource.dyc.edu/gitweb/?p=sthttpd.git;a=commitdiff;h=d2e186dbd58d274a0dea9b59357edc8498b5388d MLIST [oss-security] 20130222 Re: CVE request: sthttpd world-redable logdir CONFIRM https://bugs.gentoo.org/show_bug.cgi?id=458896 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=924857 thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.

cpe:/o:linux:linux_kernel:3.0:rc1 cpe:/o:linux:linux_kernel:3.0:rc2 cpe:/o:linux:linux_kernel:3.0:rc3 cpe:/o:linux:linux_kernel:3.0:rc4 cpe:/o:linux:linux_kernel:3.0:rc5 cpe:/o:linux:linux_kernel:3.0:rc6 cpe:/o:linux:linux_kernel:3.0:rc7 cpe:/o:linux:linux_kernel:3.0.1 cpe:/o:linux:linux_kernel:3.0.2 cpe:/o:linux:linux_kernel:3.0.3 cpe:/o:linux:linux_kernel:3.0.4 cpe:/o:linux:linux_kernel:3.0.5 cpe:/o:linux:linux_kernel:3.0.6 cpe:/o:linux:linux_kernel:3.0.7 cpe:/o:linux:linux_kernel:3.0.8 cpe:/o:linux:linux_kernel:3.0.9 cpe:/o:linux:linux_kernel:3.0.10 cpe:/o:linux:linux_kernel:3.0.11 cpe:/o:linux:linux_kernel:3.0.12 cpe:/o:linux:linux_kernel:3.0.13 cpe:/o:linux:linux_kernel:3.0.14 cpe:/o:linux:linux_kernel:3.0.15 cpe:/o:linux:linux_kernel:3.0.16 cpe:/o:linux:linux_kernel:3.0.17 cpe:/o:linux:linux_kernel:3.0.18 cpe:/o:linux:linux_kernel:3.0.19 cpe:/o:linux:linux_kernel:3.0.20 cpe:/o:linux:linux_kernel:3.0.21 cpe:/o:linux:linux_kernel:3.0.22 cpe:/o:linux:linux_kernel:3.0.23 cpe:/o:linux:linux_kernel:3.0.24 cpe:/o:linux:linux_kernel:3.0.25 cpe:/o:linux:linux_kernel:3.0.26 cpe:/o:linux:linux_kernel:3.0.27 cpe:/o:linux:linux_kernel:3.0.28 cpe:/o:linux:linux_kernel:3.0.29 cpe:/o:linux:linux_kernel:3.0.30 cpe:/o:linux:linux_kernel:3.0.31 cpe:/o:linux:linux_kernel:3.0.32 cpe:/o:linux:linux_kernel:3.0.33 cpe:/o:linux:linux_kernel:3.0.34 cpe:/o:linux:linux_kernel:3.0.35 cpe:/o:linux:linux_kernel:3.0.36 cpe:/o:linux:linux_kernel:3.0.37 cpe:/o:linux:linux_kernel:3.0.38 cpe:/o:linux:linux_kernel:3.0.39 cpe:/o:linux:linux_kernel:3.0.40 cpe:/o:linux:linux_kernel:3.0.41 cpe:/o:linux:linux_kernel:3.0.42 cpe:/o:linux:linux_kernel:3.0.43 cpe:/o:linux:linux_kernel:3.0.44 cpe:/o:linux:linux_kernel:3.1 cpe:/o:linux:linux_kernel:3.1:rc1 cpe:/o:linux:linux_kernel:3.1:rc2 cpe:/o:linux:linux_kernel:3.1:rc3 cpe:/o:linux:linux_kernel:3.1:rc4 cpe:/o:linux:linux_kernel:3.1.1 cpe:/o:linux:linux_kernel:3.1.2 cpe:/o:linux:linux_kernel:3.1.3 cpe:/o:linux:linux_kernel:3.1.4 cpe:/o:linux:linux_kernel:3.1.5 cpe:/o:linux:linux_kernel:3.1.6 cpe:/o:linux:linux_kernel:3.1.7 cpe:/o:linux:linux_kernel:3.1.8 cpe:/o:linux:linux_kernel:3.1.9 cpe:/o:linux:linux_kernel:3.1.10 cpe:/o:linux:linux_kernel:3.2 cpe:/o:linux:linux_kernel:3.2:rc2 cpe:/o:linux:linux_kernel:3.2:rc3 cpe:/o:linux:linux_kernel:3.2:rc4 cpe:/o:linux:linux_kernel:3.2:rc5 cpe:/o:linux:linux_kernel:3.2:rc6 cpe:/o:linux:linux_kernel:3.2:rc7 cpe:/o:linux:linux_kernel:3.2.1 cpe:/o:linux:linux_kernel:3.2.2 cpe:/o:linux:linux_kernel:3.2.3 cpe:/o:linux:linux_kernel:3.2.4 cpe:/o:linux:linux_kernel:3.2.5 cpe:/o:linux:linux_kernel:3.2.6 cpe:/o:linux:linux_kernel:3.2.7 cpe:/o:linux:linux_kernel:3.2.8 cpe:/o:linux:linux_kernel:3.2.9 cpe:/o:linux:linux_kernel:3.2.10 cpe:/o:linux:linux_kernel:3.2.11 cpe:/o:linux:linux_kernel:3.2.12 cpe:/o:linux:linux_kernel:3.2.13 cpe:/o:linux:linux_kernel:3.2.14 cpe:/o:linux:linux_kernel:3.2.15 cpe:/o:linux:linux_kernel:3.2.16 cpe:/o:linux:linux_kernel:3.2.17 cpe:/o:linux:linux_kernel:3.2.18 cpe:/o:linux:linux_kernel:3.2.19 cpe:/o:linux:linux_kernel:3.2.20 cpe:/o:linux:linux_kernel:3.2.21 cpe:/o:linux:linux_kernel:3.2.22 cpe:/o:linux:linux_kernel:3.2.23 cpe:/o:linux:linux_kernel:3.2.24 cpe:/o:linux:linux_kernel:3.2.25 cpe:/o:linux:linux_kernel:3.2.26 cpe:/o:linux:linux_kernel:3.2.27 cpe:/o:linux:linux_kernel:3.2.28 cpe:/o:linux:linux_kernel:3.2.29 cpe:/o:linux:linux_kernel:3.2.30 cpe:/o:linux:linux_kernel:3.3 cpe:/o:linux:linux_kernel:3.3:rc1 cpe:/o:linux:linux_kernel:3.3:rc2 cpe:/o:linux:linux_kernel:3.3:rc3 cpe:/o:linux:linux_kernel:3.3:rc4 cpe:/o:linux:linux_kernel:3.3:rc5 cpe:/o:linux:linux_kernel:3.3:rc6 cpe:/o:linux:linux_kernel:3.3:rc7 cpe:/o:linux:linux_kernel:3.3.1 cpe:/o:linux:linux_kernel:3.3.2 cpe:/o:linux:linux_kernel:3.3.3 cpe:/o:linux:linux_kernel:3.3.4 cpe:/o:linux:linux_kernel:3.3.5 cpe:/o:linux:linux_kernel:3.3.6 cpe:/o:linux:linux_kernel:3.3.7 cpe:/o:linux:linux_kernel:3.3.8 cpe:/o:linux:linux_kernel:3.4 cpe:/o:linux:linux_kernel:3.4:rc1 cpe:/o:linux:linux_kernel:3.4:rc2 cpe:/o:linux:linux_kernel:3.4:rc3 cpe:/o:linux:linux_kernel:3.4:rc4 cpe:/o:linux:linux_kernel:3.4:rc5 cpe:/o:linux:linux_kernel:3.4:rc6 cpe:/o:linux:linux_kernel:3.4:rc7 cpe:/o:linux:linux_kernel:3.4.1 cpe:/o:linux:linux_kernel:3.4.2 cpe:/o:linux:linux_kernel:3.4.3 cpe:/o:linux:linux_kernel:3.4.4 cpe:/o:linux:linux_kernel:3.4.5 cpe:/o:linux:linux_kernel:3.4.6 cpe:/o:linux:linux_kernel:3.4.7 cpe:/o:linux:linux_kernel:3.4.8 cpe:/o:linux:linux_kernel:3.4.9 cpe:/o:linux:linux_kernel:3.4.10 cpe:/o:linux:linux_kernel:3.4.11 cpe:/o:linux:linux_kernel:3.4.12 cpe:/o:linux:linux_kernel:3.4.13 cpe:/o:linux:linux_kernel:3.4.14 cpe:/o:linux:linux_kernel:3.4.15 cpe:/o:linux:linux_kernel:3.4.16 cpe:/o:linux:linux_kernel:3.4.17 cpe:/o:linux:linux_kernel:3.4.18 cpe:/o:linux:linux_kernel:3.4.19 cpe:/o:linux:linux_kernel:3.4.20 cpe:/o:linux:linux_kernel:3.4.21 cpe:/o:linux:linux_kernel:3.4.22 cpe:/o:linux:linux_kernel:3.4.23 cpe:/o:linux:linux_kernel:3.4.24 cpe:/o:linux:linux_kernel:3.5.1 cpe:/o:linux:linux_kernel:3.5.2 cpe:/o:linux:linux_kernel:3.5.3 cpe:/o:linux:linux_kernel:3.5.4 cpe:/o:linux:linux_kernel:3.5.5 cpe:/o:linux:linux_kernel:3.5.6 cpe:/o:linux:linux_kernel:3.5.7 cpe:/o:linux:linux_kernel:3.6 cpe:/o:linux:linux_kernel:3.6.1 cpe:/o:linux:linux_kernel:3.6.2 cpe:/o:linux:linux_kernel:3.6.3 cpe:/o:linux:linux_kernel:3.6.4 cpe:/o:linux:linux_kernel:3.6.5 cpe:/o:linux:linux_kernel:3.6.6 cpe:/o:linux:linux_kernel:3.6.7 cpe:/o:linux:linux_kernel:3.6.8 cpe:/o:linux:linux_kernel:3.6.9 cpe:/o:linux:linux_kernel:3.6.10 cpe:/o:linux:linux_kernel:3.6.11 cpe:/o:linux:linux_kernel:3.7 cpe:/o:linux:linux_kernel:3.7.1 cpe:/o:linux:linux_kernel:3.7.2 cpe:/o:linux:linux_kernel:3.7.3 cpe:/o:linux:linux_kernel:3.7.4 cpe:/o:linux:linux_kernel:3.7.5

CVE-2013-0349

2013-02-28T14:55:01.323-05:00

2013-06-04T23:40:50.857-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a9ab9bdb3e891762553f667066190c1d22ad62b REDHAT RHSA-2013:0744 CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6 MLIST [oss-security] 20130222 Re: CVE request: Linux kernel: Bluetooth HIDP information disclosure UBUNTU USN-1805-1 UBUNTU USN-1808-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=914298 CONFIRM https://github.com/torvalds/linux/commit/0a9ab9bdb3e891762553f667066190c1d22ad62b The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.

cpe:/a:david_leonard:pkstat:1.8.5

CVE-2013-0350

2014-05-05T13:06:03.107-04:00

2014-05-05T13:27:13.307-04:00

6.3

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-05-05T13:27:13.243-04:00

MLIST [oss-security] 20130222 CVE-2013-0350 for pktstat: writes content from TCP streams to public readable file /tmp/smtp.log CONFIRM https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701211 tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.

cpe:/a:oracle:jdk:1.6.0:update_22 cpe:/a:oracle:jdk:1.6.0:update_23 cpe:/a:oracle:jdk:1.6.0:update_24 cpe:/a:oracle:jdk:1.6.0:update_25 cpe:/a:oracle:jdk:1.6.0:update_26 cpe:/a:oracle:jdk:1.6.0:update_27 cpe:/a:oracle:jdk:1.6.0:update_29 cpe:/a:oracle:jdk:1.6.0:update_30 cpe:/a:oracle:jdk:1.6.0:update_31 cpe:/a:oracle:jdk:1.6.0:update_32 cpe:/a:oracle:jdk:1.6.0:update_33 cpe:/a:oracle:jdk:1.6.0:update_34 cpe:/a:oracle:jdk:1.6.0:update_35 cpe:/a:oracle:jdk:1.6.0:update_37 cpe:/a:oracle:jdk:1.6.0:update_38 cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update11 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.6.0:update_22 cpe:/a:oracle:jre:1.6.0:update_23 cpe:/a:oracle:jre:1.6.0:update_24 cpe:/a:oracle:jre:1.6.0:update_25 cpe:/a:oracle:jre:1.6.0:update_26 cpe:/a:oracle:jre:1.6.0:update_27 cpe:/a:oracle:jre:1.6.0:update_29 cpe:/a:oracle:jre:1.6.0:update_30 cpe:/a:oracle:jre:1.6.0:update_31 cpe:/a:oracle:jre:1.6.0:update_32 cpe:/a:oracle:jre:1.6.0:update_33 cpe:/a:oracle:jre:1.6.0:update_34 cpe:/a:oracle:jre:1.6.0:update_35 cpe:/a:oracle:jre:1.6.0:update_37 cpe:/a:oracle:jre:1.6.0:update_38 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update11 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9 cpe:/a:sun:jdk:1.6.0 cpe:/a:sun:jdk:1.6.0:update1 cpe:/a:sun:jdk:1.6.0:update1_b06 cpe:/a:sun:jdk:1.6.0:update2 cpe:/a:sun:jdk:1.6.0:update_10 cpe:/a:sun:jdk:1.6.0:update_11 cpe:/a:sun:jdk:1.6.0:update_12 cpe:/a:sun:jdk:1.6.0:update_13 cpe:/a:sun:jdk:1.6.0:update_14 cpe:/a:sun:jdk:1.6.0:update_15 cpe:/a:sun:jdk:1.6.0:update_16 cpe:/a:sun:jdk:1.6.0:update_17 cpe:/a:sun:jdk:1.6.0:update_18 cpe:/a:sun:jdk:1.6.0:update_19 cpe:/a:sun:jdk:1.6.0:update_20 cpe:/a:sun:jdk:1.6.0:update_21 cpe:/a:sun:jdk:1.6.0:update_3 cpe:/a:sun:jdk:1.6.0:update_4 cpe:/a:sun:jdk:1.6.0:update_5 cpe:/a:sun:jdk:1.6.0:update_6 cpe:/a:sun:jdk:1.6.0:update_7 cpe:/a:sun:jre:1.6.0 cpe:/a:sun:jre:1.6.0:update_1 cpe:/a:sun:jre:1.6.0:update_10 cpe:/a:sun:jre:1.6.0:update_11 cpe:/a:sun:jre:1.6.0:update_12 cpe:/a:sun:jre:1.6.0:update_13 cpe:/a:sun:jre:1.6.0:update_14 cpe:/a:sun:jre:1.6.0:update_15 cpe:/a:sun:jre:1.6.0:update_16 cpe:/a:sun:jre:1.6.0:update_17 cpe:/a:sun:jre:1.6.0:update_18 cpe:/a:sun:jre:1.6.0:update_19 cpe:/a:sun:jre:1.6.0:update_2 cpe:/a:sun:jre:1.6.0:update_20 cpe:/a:sun:jre:1.6.0:update_21 cpe:/a:sun:jre:1.6.0:update_3 cpe:/a:sun:jre:1.6.0:update_4 cpe:/a:sun:jre:1.6.0:update_5 cpe:/a:sun:jre:1.6.0:update_6 cpe:/a:sun:jre:1.6.0:update_7 cpe:/a:sun:jre:1.6.0:update_9

CVE-2013-0351

2013-02-01T19:55:01.380-05:00

2017-09-18T21:35:37.013-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57720 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

cpe:/a:oracle:enterprise_manager_database_control:10.2.0.3 cpe:/a:oracle:enterprise_manager_database_control:10.2.0.4 cpe:/a:oracle:enterprise_manager_database_control:10.2.0.5 cpe:/a:oracle:enterprise_manager_database_control:11.1.0.7 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.2 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.3 cpe:/a:oracle:enterprise_manager_grid_control:10.2.0.5 cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_plugin_for_database_control:12.1.0.1 cpe:/a:oracle:enterprise_manager_plugin_for_database_control:12.1.0.2

CVE-2013-0352

2013-01-16T20:55:03.310-05:00

2015-10-08T10:35:34.007-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-10-08T10:16:35.590-04:00

HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html BID 57365 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Content Management.

cpe:/a:oracle:enterprise_manager_database_control:11.1.0.7 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.2 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.3 cpe:/a:oracle:enterprise_manager_grid_control:10.2.0.5 cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_plugin_for_database_control:12.1.0.1

CVE-2013-0353

2013-01-16T20:55:03.357-05:00

2013-10-10T23:48:40.717-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 allows remote attackers to affect integrity via unknown vectors related to Enterprise Configuration Management.

CVE-2013-0354

2013-01-16T20:55:03.420-05:00

2014-03-16T00:33:15.737-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Policy Framework.

CVE-2013-0355

2013-01-16T20:55:03.467-05:00

2013-10-10T23:48:40.857-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.

cpe:/a:oracle:peoplesoft_products:8.51 cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0356

2013-01-16T20:55:03.500-05:00

2013-10-10T23:48:40.933-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.

cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0357

2013-01-16T20:55:03.547-05:00

2013-10-10T23:48:40.997-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.

CVE-2013-0358

2013-01-16T20:55:03.593-05:00

2013-10-10T23:48:41.073-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Resource Manager.

cpe:/a:oracle:enterprise_manager_grid_control:6.5 cpe:/a:oracle:enterprise_manager_grid_control:11.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.2

CVE-2013-0359

2013-01-16T20:55:03.640-05:00

2013-10-10T23:48:41.153-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the APM - Application Performance Management component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Business Transaction Management.

cpe:/a:oracle:enterprise_manager_grid_control:6.5 cpe:/a:oracle:enterprise_manager_grid_control:11.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.2

CVE-2013-0360

2013-01-16T20:55:03.670-05:00

2013-10-10T23:48:41.263-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Application Performance Management (APM) component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Business Transaction Management, a different vulnerability than CVE-2013-0396.

cpe:/a:oracle:database_lite:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:11.1.0.0

CVE-2013-0361

2013-01-16T20:55:03.717-05:00

2014-03-16T00:33:16.457-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0366.

cpe:/a:oracle:database_mobile%2flite_server:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:11.1.0.0

CVE-2013-0362

2013-01-16T20:55:03.750-05:00

2013-10-10T23:48:41.417-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0363 and CVE-2013-0364.

cpe:/a:oracle:database_mobile%2flite_server:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:11.1.0.0

CVE-2013-0363

2013-01-16T20:55:03.797-05:00

2014-03-16T00:33:16.737-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0362 and CVE-2013-0364.

cpe:/a:oracle:database_lite:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:11.1.0.0

CVE-2013-0364

2013-01-16T20:55:03.843-05:00

2014-03-16T00:33:16.830-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0362 and CVE-2013-0363.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2013-0365

2013-01-16T20:55:03.873-05:00

2013-10-10T23:48:41.653-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.

cpe:/a:oracle:database_mobile%2flite_server:10.3.0.3 cpe:/a:oracle:database_mobile%2flite_server:11.1.0.0

CVE-2013-0366

2013-01-16T20:55:03.920-05:00

2014-03-16T00:33:17.080-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0361.

cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28

CVE-2013-0367

2013-01-16T20:55:03.953-05:00

2017-09-18T21:35:37.090-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

CVE-2013-0368

2013-01-16T20:55:04.000-05:00

2017-09-18T21:35:37.153-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:peoplesoft_products:8.51 cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0369

2013-01-16T20:55:04.047-05:00

2013-10-10T23:48:41.967-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Query.

cpe:/a:oracle:supply_chain_products_suite:9.3.1.1

CVE-2013-0370

2013-01-16T20:55:04.093-05:00

2013-10-10T23:48:42.043-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.

CVE-2013-0371

2013-01-16T20:55:04.123-05:00

2017-09-18T21:35:37.217-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:enterprise_manager_database_control:11.1.0.7 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.2 cpe:/a:oracle:enterprise_manager_database_control:11.2.0.3 cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.1 cpe:/a:oracle:enterprise_manager_plugin_for_database_control:12.1.0.2

CVE-2013-0372

2013-01-16T20:55:04.170-05:00

2015-10-08T10:37:14.583-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2015-10-08T10:13:30.017-04:00

HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html BID 57378 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1 and 12.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.

CVE-2013-0373

2013-01-16T20:55:04.217-05:00

2013-10-10T23:48:42.310-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.

CVE-2013-0374

2013-01-16T20:55:04.250-05:00

2013-10-10T23:48:42.387-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Database Cloning.

cpe:/a:oracle:mysql:5.1.0 cpe:/a:oracle:mysql:5.1.3 cpe:/a:oracle:mysql:5.1.4 cpe:/a:oracle:mysql:5.1.5 cpe:/a:oracle:mysql:5.1.6 cpe:/a:oracle:mysql:5.1.7 cpe:/a:oracle:mysql:5.1.9 cpe:/a:oracle:mysql:5.1.11 cpe:/a:oracle:mysql:5.1.12 cpe:/a:oracle:mysql:5.1.13 cpe:/a:oracle:mysql:5.1.14 cpe:/a:oracle:mysql:5.1.15 cpe:/a:oracle:mysql:5.1.16 cpe:/a:oracle:mysql:5.1.17 cpe:/a:oracle:mysql:5.1.18 cpe:/a:oracle:mysql:5.1.19 cpe:/a:oracle:mysql:5.1.20 cpe:/a:oracle:mysql:5.1.21 cpe:/a:oracle:mysql:5.1.22 cpe:/a:oracle:mysql:5.1.23 cpe:/a:oracle:mysql:5.1.24 cpe:/a:oracle:mysql:5.1.25 cpe:/a:oracle:mysql:5.1.26 cpe:/a:oracle:mysql:5.1.28 cpe:/a:oracle:mysql:5.1.29 cpe:/a:oracle:mysql:5.1.30 cpe:/a:oracle:mysql:5.1.31 cpe:/a:oracle:mysql:5.1.32 cpe:/a:oracle:mysql:5.1.33 cpe:/a:oracle:mysql:5.1.34 cpe:/a:oracle:mysql:5.1.35 cpe:/a:oracle:mysql:5.1.36 cpe:/a:oracle:mysql:5.1.37 cpe:/a:oracle:mysql:5.1.38 cpe:/a:oracle:mysql:5.1.39 cpe:/a:oracle:mysql:5.1.40 cpe:/a:oracle:mysql:5.1.41 cpe:/a:oracle:mysql:5.1.42 cpe:/a:oracle:mysql:5.1.43 cpe:/a:oracle:mysql:5.1.44 cpe:/a:oracle:mysql:5.1.45 cpe:/a:oracle:mysql:5.1.46 cpe:/a:oracle:mysql:5.1.47 cpe:/a:oracle:mysql:5.1.48 cpe:/a:oracle:mysql:5.1.49 cpe:/a:oracle:mysql:5.1.50 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66

CVE-2013-0375

2013-01-16T20:55:04.297-05:00

2019-09-27T13:48:01.557-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-27T09:19:11.767-04:00

REDHAT RHSA-2013:0219 GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0376

2013-01-16T20:55:04.343-05:00

2013-10-10T23:48:42.527-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Diagnostics.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0377

2013-01-16T20:55:04.390-05:00

2013-10-10T23:48:42.607-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Client System Analyzer.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2013-0378

2013-01-16T20:55:04.420-05:00

2013-10-10T23:48:42.683-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Siebel Calendar, a different vulnerability than CVE-2013-0379.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2013-0379

2013-01-16T20:55:04.467-05:00

2013-10-10T23:48:42.777-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Siebel Calendar, a different vulnerability than CVE-2013-0378.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.1 cpe:/a:oracle:e-business_suite:12.1.2 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0380

2013-01-16T20:55:04.967-05:00

2013-10-10T23:48:42.857-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Payroll component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to View Payslip.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0381

2013-01-16T20:55:05.017-05:00

2014-03-16T00:33:19.363-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Application Framework.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.1 cpe:/a:oracle:e-business_suite:12.1.2 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0382

2013-01-16T20:55:05.063-05:00

2013-10-10T23:48:43.013-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Campaign Management.

cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.9 cpe:/a:oracle:mysql:5.1.51 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.66 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28

CVE-2013-0383

2013-01-16T20:55:05.127-05:00

2017-09-18T21:35:37.357-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2013:0219 GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.

CVE-2013-0384

2013-01-16T20:55:05.173-05:00

2017-09-18T21:35:37.433-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2013:0219 GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Information Schema.

CVE-2013-0385

2013-01-16T20:55:05.217-05:00

2017-09-18T21:35:37.513-04:00

6.6

LOCAL

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov REDHAT RHSA-2013:0219 GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users to affect confidentiality and integrity via unknown vectors related to Server Replication.

CVE-2013-0386

2013-01-16T20:55:05.250-05:00

2017-09-18T21:35:37.573-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

cpe:/a:oracle:peoplesoft_products:8.51 cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0387

2013-01-16T20:55:05.297-05:00

2013-10-10T23:48:43.370-04:00

4.3

NETWORK

MEDIUM

MULTIPLE_INSTANCES

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to PeopleCode.

cpe:/a:oracle:peoplesoft_products:9.1

CVE-2013-0388

2013-01-16T20:55:05.343-05:00

2013-10-10T23:48:43.450-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft HRMS component in Oracle PeopleSoft Products 9.1 allows remote attackers to affect integrity via unknown vectors related to Mobile Company Directory.

CVE-2013-0389

2013-01-16T20:55:05.390-05:00

2017-09-18T21:35:37.700-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2013:0219 GENTOO GLSA-201308-06 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html UBUNTU USN-1703-1 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0390

2013-01-16T20:55:05.437-05:00

2013-10-10T23:48:43.620-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Bookmarkable Pages.

cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0391

2013-01-16T20:55:05.470-05:00

2013-10-10T23:48:43.717-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Security.

cpe:/a:oracle:peoplesoft_products:8.51 cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0392

2013-01-16T20:55:05.517-05:00

2013-10-10T23:48:43.793-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote attackers to affect integrity via unknown vectors related to Portal, a different vulnerability than CVE-2012-5059.

cpe:/a:oracle:fusion_middleware:8.3.7.0 cpe:/a:oracle:fusion_middleware:8.4

CVE-2013-0393

2013-01-16T20:55:05.563-05:00

2018-10-12T18:03:48.800-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CERT TA13-043B CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS MS13-012 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0418.

cpe:/a:oracle:peoplesoft_products:9.0 cpe:/a:oracle:peoplesoft_products:9.1

CVE-2013-0394

2013-01-16T20:55:05.593-05:00

2013-10-10T23:48:44.090-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft HRMS component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote attackers to affect confidentiality via unknown vectors related to Candidate Gateway.

cpe:/a:oracle:peoplesoft_products:8.51 cpe:/a:oracle:peoplesoft_products:8.52

CVE-2013-0395

2013-01-16T20:55:05.640-05:00

2013-10-10T23:48:44.153-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Security.

cpe:/a:oracle:enterprise_manager_grid_control:6.5 cpe:/a:oracle:enterprise_manager_grid_control:11.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.2

CVE-2013-0396

2013-01-16T20:55:05.687-05:00

2013-10-10T23:48:44.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Application Performance Management (APM) component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Business Transaction Management, a different vulnerability than CVE-2013-0360.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.0.6 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2013-0397

2013-01-16T20:55:05.720-05:00

2014-03-16T00:33:21.817-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBST02955 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diagnostics.

cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0398

2013-07-17T09:41:13.640-04:00

2017-09-18T21:35:37.810-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality via unknown vectors related to Utility/Remote Execution Server (in.rexecd).

cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10

CVE-2013-0399

2013-01-16T20:55:05.767-05:00

2017-09-18T21:35:37.870-04:00

6.6

LOCAL

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CONFIRM http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf Unspecified vulnerability in Oracle Sun Solaris 9 and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Umount.

cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10

CVE-2013-0400

2013-01-16T20:55:05.813-05:00

2017-09-18T21:35:37.917-04:00

6.6

LOCAL

MEDIUM

SINGLE_INSTANCE

COMPLETE

cpe:/a:oracle:jdk:1.7.0:update17 cpe:/a:oracle:jre:1.7.0:update17

CVE-2013-0401

2013-03-08T13:55:01.553-05:00

2017-09-18T21:35:38.013-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ CONFIRM http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ HP SSRT101305 MISC http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 MISC http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044 SUSE SUSE-SU-2013:0814 SUSE SUSE-SU-2013:0835 SUSE SUSE-SU-2013:0871 SUSE openSUSE-SU-2013:0777 SUSE openSUSE-SU-2013:0964 MLIST [distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! HP SSRT101252 REDHAT RHSA-2013:0752 REDHAT RHSA-2013:0757 REDHAT RHSA-2013:0758 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 MANDRIVA MDVSA-2013:145 MANDRIVA MDVSA-2013:161 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html UBUNTU USN-1806-1 CERT TA13-107A MISC http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ MISC https://bugzilla.redhat.com/show_bug.cgi?id=920245 MISC https://twitter.com/thezdi/status/309784608508100608 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.

cpe:/a:oracle:javafx:2.2.7 cpe:/a:oracle:jdk:1.7.0:update17 cpe:/a:oracle:jre:1.7.0:update17

CVE-2013-0402

2013-03-08T13:55:01.567-05:00

2017-09-18T21:35:38.073-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 REDHAT RHSA-2013:0757 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html CERT TA13-107A MISC http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ MISC https://twitter.com/thezdi/status/309484730506698752 Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.

cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0403

2013-04-17T08:14:51.400-04:00

2017-09-18T21:35:38.277-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Utility.

cpe:/o:sun:sunos:5.10

CVE-2013-0404

2013-04-17T08:14:51.430-04:00

2017-09-18T21:35:38.340-04:00

3.7

LOCAL

HIGH

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/Boot.

cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0405

2013-04-17T08:14:51.457-04:00

2017-09-18T21:35:38.403-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality and integrity via vectors related to NFS client mounts and IPv6.

cpe:/o:sun:sunos:5.10

CVE-2013-0406

2013-04-17T08:14:51.483-04:00

2017-09-18T21:35:38.450-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect integrity via unknown vectors via vectors related to Kernel/IPsec.

cpe:/a:xerox:freeflow_print_server:8.0 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0407

2013-01-16T20:55:05.843-05:00

2017-09-18T21:35:38.497-04:00

4.6

LOCAL

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CONFIRM http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/DTrace Framework.

cpe:/o:sun:sunos:5.10

CVE-2013-0408

2013-04-17T08:14:51.513-04:00

2017-09-18T21:35:38.543-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to CPU performance counters drivers.

cpe:/a:oracle:jdk:1.5.0:update_36 cpe:/a:oracle:jdk:1.5.0:update_38 cpe:/a:oracle:jdk:1.6.0:update_22 cpe:/a:oracle:jdk:1.6.0:update_23 cpe:/a:oracle:jdk:1.6.0:update_24 cpe:/a:oracle:jdk:1.6.0:update_25 cpe:/a:oracle:jdk:1.6.0:update_26 cpe:/a:oracle:jdk:1.6.0:update_27 cpe:/a:oracle:jdk:1.6.0:update_29 cpe:/a:oracle:jdk:1.6.0:update_30 cpe:/a:oracle:jdk:1.6.0:update_31 cpe:/a:oracle:jdk:1.6.0:update_32 cpe:/a:oracle:jdk:1.6.0:update_33 cpe:/a:oracle:jdk:1.6.0:update_34 cpe:/a:oracle:jdk:1.6.0:update_35 cpe:/a:oracle:jdk:1.6.0:update_37 cpe:/a:oracle:jdk:1.6.0:update_38 cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update11 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.5.0:update_36 cpe:/a:oracle:jre:1.5.0:update_38 cpe:/a:oracle:jre:1.6.0:update_22 cpe:/a:oracle:jre:1.6.0:update_23 cpe:/a:oracle:jre:1.6.0:update_24 cpe:/a:oracle:jre:1.6.0:update_25 cpe:/a:oracle:jre:1.6.0:update_26 cpe:/a:oracle:jre:1.6.0:update_27 cpe:/a:oracle:jre:1.6.0:update_29 cpe:/a:oracle:jre:1.6.0:update_30 cpe:/a:oracle:jre:1.6.0:update_31 cpe:/a:oracle:jre:1.6.0:update_32 cpe:/a:oracle:jre:1.6.0:update_33 cpe:/a:oracle:jre:1.6.0:update_34 cpe:/a:oracle:jre:1.6.0:update_35 cpe:/a:oracle:jre:1.6.0:update_37 cpe:/a:oracle:jre:1.6.0:update_38 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update11 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9 cpe:/a:sun:jdk:1.5.0 cpe:/a:sun:jdk:1.5.0:update1 cpe:/a:sun:jdk:1.5.0:update10 cpe:/a:sun:jdk:1.5.0:update11 cpe:/a:sun:jdk:1.5.0:update11_b03 cpe:/a:sun:jdk:1.5.0:update12 cpe:/a:sun:jdk:1.5.0:update13 cpe:/a:sun:jdk:1.5.0:update14 cpe:/a:sun:jdk:1.5.0:update15 cpe:/a:sun:jdk:1.5.0:update16 cpe:/a:sun:jdk:1.5.0:update17 cpe:/a:sun:jdk:1.5.0:update18 cpe:/a:sun:jdk:1.5.0:update19 cpe:/a:sun:jdk:1.5.0:update2 cpe:/a:sun:jdk:1.5.0:update20 cpe:/a:sun:jdk:1.5.0:update21 cpe:/a:sun:jdk:1.5.0:update22 cpe:/a:sun:jdk:1.5.0:update23 cpe:/a:sun:jdk:1.5.0:update24 cpe:/a:sun:jdk:1.5.0:update25 cpe:/a:sun:jdk:1.5.0:update26 cpe:/a:sun:jdk:1.5.0:update27 cpe:/a:sun:jdk:1.5.0:update28 cpe:/a:sun:jdk:1.5.0:update29 cpe:/a:sun:jdk:1.5.0:update3 cpe:/a:sun:jdk:1.5.0:update31 cpe:/a:sun:jdk:1.5.0:update33 cpe:/a:sun:jdk:1.5.0:update4 cpe:/a:sun:jdk:1.5.0:update5 cpe:/a:sun:jdk:1.5.0:update6 cpe:/a:sun:jdk:1.5.0:update7 cpe:/a:sun:jdk:1.5.0:update7_b03 cpe:/a:sun:jdk:1.5.0:update8 cpe:/a:sun:jdk:1.5.0:update9 cpe:/a:sun:jdk:1.6.0 cpe:/a:sun:jdk:1.6.0:update1 cpe:/a:sun:jdk:1.6.0:update1_b06 cpe:/a:sun:jdk:1.6.0:update2 cpe:/a:sun:jdk:1.6.0:update_10 cpe:/a:sun:jdk:1.6.0:update_11 cpe:/a:sun:jdk:1.6.0:update_12 cpe:/a:sun:jdk:1.6.0:update_13 cpe:/a:sun:jdk:1.6.0:update_14 cpe:/a:sun:jdk:1.6.0:update_15 cpe:/a:sun:jdk:1.6.0:update_16 cpe:/a:sun:jdk:1.6.0:update_17 cpe:/a:sun:jdk:1.6.0:update_18 cpe:/a:sun:jdk:1.6.0:update_19 cpe:/a:sun:jdk:1.6.0:update_20 cpe:/a:sun:jdk:1.6.0:update_21 cpe:/a:sun:jdk:1.6.0:update_3 cpe:/a:sun:jdk:1.6.0:update_4 cpe:/a:sun:jdk:1.6.0:update_5 cpe:/a:sun:jdk:1.6.0:update_6 cpe:/a:sun:jdk:1.6.0:update_7 cpe:/a:sun:jre:1.5.0 cpe:/a:sun:jre:1.5.0:update1 cpe:/a:sun:jre:1.5.0:update10 cpe:/a:sun:jre:1.5.0:update11 cpe:/a:sun:jre:1.5.0:update12 cpe:/a:sun:jre:1.5.0:update13 cpe:/a:sun:jre:1.5.0:update14 cpe:/a:sun:jre:1.5.0:update15 cpe:/a:sun:jre:1.5.0:update16 cpe:/a:sun:jre:1.5.0:update17 cpe:/a:sun:jre:1.5.0:update18 cpe:/a:sun:jre:1.5.0:update19 cpe:/a:sun:jre:1.5.0:update2 cpe:/a:sun:jre:1.5.0:update20 cpe:/a:sun:jre:1.5.0:update21 cpe:/a:sun:jre:1.5.0:update22 cpe:/a:sun:jre:1.5.0:update23 cpe:/a:sun:jre:1.5.0:update24 cpe:/a:sun:jre:1.5.0:update25 cpe:/a:sun:jre:1.5.0:update26 cpe:/a:sun:jre:1.5.0:update27 cpe:/a:sun:jre:1.5.0:update28 cpe:/a:sun:jre:1.5.0:update29 cpe:/a:sun:jre:1.5.0:update3 cpe:/a:sun:jre:1.5.0:update31 cpe:/a:sun:jre:1.5.0:update33 cpe:/a:sun:jre:1.5.0:update4 cpe:/a:sun:jre:1.5.0:update5 cpe:/a:sun:jre:1.5.0:update6 cpe:/a:sun:jre:1.5.0:update7 cpe:/a:sun:jre:1.5.0:update8 cpe:/a:sun:jre:1.5.0:update9 cpe:/a:sun:jre:1.6.0 cpe:/a:sun:jre:1.6.0:update_1 cpe:/a:sun:jre:1.6.0:update_10 cpe:/a:sun:jre:1.6.0:update_11 cpe:/a:sun:jre:1.6.0:update_12 cpe:/a:sun:jre:1.6.0:update_13 cpe:/a:sun:jre:1.6.0:update_14 cpe:/a:sun:jre:1.6.0:update_15 cpe:/a:sun:jre:1.6.0:update_16 cpe:/a:sun:jre:1.6.0:update_17 cpe:/a:sun:jre:1.6.0:update_18 cpe:/a:sun:jre:1.6.0:update_19 cpe:/a:sun:jre:1.6.0:update_2 cpe:/a:sun:jre:1.6.0:update_20 cpe:/a:sun:jre:1.6.0:update_21 cpe:/a:sun:jre:1.6.0:update_3 cpe:/a:sun:jre:1.6.0:update_4 cpe:/a:sun:jre:1.6.0:update_5 cpe:/a:sun:jre:1.6.0:update_6 cpe:/a:sun:jre:1.6.0:update_7 cpe:/a:sun:jre:1.6.0:update_9

CVE-2013-0409

2013-02-01T19:55:01.443-05:00

2017-09-18T21:35:38.637-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57728 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX.

cpe:/a:oracle:supply_chain_products_suite:6.1.1.0 cpe:/a:oracle:supply_chain_products_suite:6.1.2.0 cpe:/a:oracle:supply_chain_products_suite:6.1.2.2

CVE-2013-0410

2013-04-17T08:14:51.540-04:00

2013-10-10T23:48:45.903-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in the Agile EDM component in Oracle Supply Chain Products Suite 6.1.1.0, 6.1.2.0, and 6.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Base Component - Common Objects.

cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10

CVE-2013-0411

2013-04-17T08:14:51.567-04:00

2017-09-18T21:35:38.700-04:00

5.9

LOCAL

HIGH

MULTIPLE_INSTANCES

COMPLETE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via vectors related to RBAC Configuration.

cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0412

2013-04-17T08:14:51.603-04:00

2017-09-18T21:35:38.747-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect integrity and availability via unknown vectors related to Utility/pax.

cpe:/o:sun:sunos:5.10 cpe:/o:sun:sunos:5.11

CVE-2013-0413

2013-04-17T08:14:51.650-04:00

2017-09-18T21:35:38.827-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Remote Execution Service.

cpe:/o:sun:sunos:5.11

CVE-2013-0414

2013-01-16T20:55:05.890-05:00

2013-10-10T23:48:46.183-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via unknown vectors related to Utility/ksh93.

cpe:/a:xerox:freeflow_print_server:8.0 cpe:/o:sun:sunos:5.10

CVE-2013-0415

2013-01-16T20:55:05.937-05:00

2017-09-18T21:35:38.887-04:00

6.0

LOCAL

HIGH

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CONFIRM http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Bind/Postinstall script for Bind package.

cpe:/a:oracle:siebel_crm:8.1.1 cpe:/a:oracle:siebel_crm:8.2.2

CVE-2013-0416

2013-04-17T08:14:51.687-04:00

2013-10-10T23:48:46.323-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Unspecified vulnerability in the Siebel Enterprise Application Integration component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Services, a different vulnerability than CVE-2013-2403.

cpe:/a:oracle:sun_products_suite:6.9.0

CVE-2013-0417

2013-01-16T20:55:05.970-05:00

2013-10-10T23:48:46.403-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Sun Storage Common Array Manager (CAM) component in Oracle Sun Products Suite 6.9.0 allows remote attackers to affect confidentiality, related to Fault Management System (FMS).

cpe:/a:microsoft:exchange_server:2007:sp3 cpe:/a:microsoft:exchange_server:2010:sp2 cpe:/a:oracle:fusion_middleware:8.3.7.0 cpe:/a:oracle:fusion_middleware:8.4

CVE-2013-0418

2013-01-16T20:55:06.017-05:00

2018-10-12T18:03:49.330-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20130117 Secunia Research: Oracle Outside In Technology Paradox Database Handling Buffer Overflow MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CERT TA13-043B CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS MS13-012 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be triggered using a table header with a crafted "number of fields" value.

CVE-2013-0419

2013-02-01T19:55:01.473-05:00

2017-09-18T21:35:39.027-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57714 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

cpe:/a:oracle:virtualization:4.0 cpe:/a:oracle:virtualization:4.1 cpe:/a:oracle:virtualization:4.2 cpe:/a:oracle:vm_virtualbox:4.0 cpe:/a:oracle:vm_virtualbox:4.1.0 cpe:/a:oracle:vm_virtualbox:4.2.0 cpe:/o:opensuse:opensuse:12.1 cpe:/o:opensuse:opensuse:12.2

CVE-2013-0420

2013-01-16T20:55:06.063-05:00

2018-10-30T12:27:33.937-04:00

2.4

LOCAL

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2013:0231 MANDRIVA MDVSA-2013:150 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=798776 MISC https://www.virtualbox.org/changeset/44055/vbox Unspecified vulnerability in the VirtualBox component in Oracle Virtualization 4.0, 4.1, and 4.2 allows local users to affect integrity and availability via unknown vectors related to Core. NOTE: The previous information was obtained from the January 2013 Oracle CPU. Oracle has not commented on claims from another vendor that this issue is related to an incorrect comparison in the vga_draw_text function in Devices/Graphics/DevVGA.cpp, which can cause VirtualBox to "draw more lines than necessary."

CVE-2013-0421

2017-05-11T10:29:25.107-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9

CVE-2013-0422

2013-01-10T16:55:00.777-05:00

2014-02-20T23:56:53.360-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html MISC http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/ MISC http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html MISC http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/ MISC http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/ SUSE openSUSE-SU-2013:0199 MISC http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html REDHAT RHSA-2013:0156 REDHAT RHSA-2013:0165 BUGTRAQ 20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code CERT-VN VU#625617 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html UBUNTU USN-1693-1 CERT TA13-010A MISC https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf MISC https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018 MISC https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

CVE-2013-0423

2013-02-01T19:55:01.520-05:00

2017-09-18T21:35:39.247-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57716 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

cpe:/a:oracle:jdk:1.4.2_38 cpe:/a:oracle:jdk:1.4.2_40 cpe:/a:oracle:jdk:1.5.0:update_36 cpe:/a:oracle:jdk:1.5.0:update_38 cpe:/a:oracle:jdk:1.6.0:update_22 cpe:/a:oracle:jdk:1.6.0:update_23 cpe:/a:oracle:jdk:1.6.0:update_24 cpe:/a:oracle:jdk:1.6.0:update_25 cpe:/a:oracle:jdk:1.6.0:update_26 cpe:/a:oracle:jdk:1.6.0:update_27 cpe:/a:oracle:jdk:1.6.0:update_29 cpe:/a:oracle:jdk:1.6.0:update_30 cpe:/a:oracle:jdk:1.6.0:update_31 cpe:/a:oracle:jdk:1.6.0:update_32 cpe:/a:oracle:jdk:1.6.0:update_33 cpe:/a:oracle:jdk:1.6.0:update_34 cpe:/a:oracle:jdk:1.6.0:update_35 cpe:/a:oracle:jdk:1.6.0:update_37 cpe:/a:oracle:jdk:1.6.0:update_38 cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update11 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.4.2_38 cpe:/a:oracle:jre:1.4.2_40 cpe:/a:oracle:jre:1.5.0:update_36 cpe:/a:oracle:jre:1.5.0:update_38 cpe:/a:oracle:jre:1.6.0:update_22 cpe:/a:oracle:jre:1.6.0:update_23 cpe:/a:oracle:jre:1.6.0:update_24 cpe:/a:oracle:jre:1.6.0:update_25 cpe:/a:oracle:jre:1.6.0:update_26 cpe:/a:oracle:jre:1.6.0:update_27 cpe:/a:oracle:jre:1.6.0:update_29 cpe:/a:oracle:jre:1.6.0:update_30 cpe:/a:oracle:jre:1.6.0:update_31 cpe:/a:oracle:jre:1.6.0:update_32 cpe:/a:oracle:jre:1.6.0:update_33 cpe:/a:oracle:jre:1.6.0:update_34 cpe:/a:oracle:jre:1.6.0:update_35 cpe:/a:oracle:jre:1.6.0:update_37 cpe:/a:oracle:jre:1.6.0:update_38 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update11 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9 cpe:/a:sun:jdk:1.4.2 cpe:/a:sun:jdk:1.4.2_1 cpe:/a:sun:jdk:1.4.2_2 cpe:/a:sun:jdk:1.4.2_3 cpe:/a:sun:jdk:1.4.2_4 cpe:/a:sun:jdk:1.4.2_5 cpe:/a:sun:jdk:1.4.2_6 cpe:/a:sun:jdk:1.4.2_7 cpe:/a:sun:jdk:1.4.2_8 cpe:/a:sun:jdk:1.4.2_9 cpe:/a:sun:jdk:1.4.2_10 cpe:/a:sun:jdk:1.4.2_11 cpe:/a:sun:jdk:1.4.2_12 cpe:/a:sun:jdk:1.4.2_13 cpe:/a:sun:jdk:1.4.2_14 cpe:/a:sun:jdk:1.4.2_15 cpe:/a:sun:jdk:1.4.2_16 cpe:/a:sun:jdk:1.4.2_17 cpe:/a:sun:jdk:1.4.2_18 cpe:/a:sun:jdk:1.4.2_19 cpe:/a:sun:jdk:1.4.2_22 cpe:/a:sun:jdk:1.4.2_23 cpe:/a:sun:jdk:1.4.2_25 cpe:/a:sun:jdk:1.4.2_26 cpe:/a:sun:jdk:1.4.2_27 cpe:/a:sun:jdk:1.4.2_28 cpe:/a:sun:jdk:1.4.2_29 cpe:/a:sun:jdk:1.4.2_30 cpe:/a:sun:jdk:1.4.2_31 cpe:/a:sun:jdk:1.4.2_32 cpe:/a:sun:jdk:1.4.2_33 cpe:/a:sun:jdk:1.4.2_34 cpe:/a:sun:jdk:1.4.2_35 cpe:/a:sun:jdk:1.4.2_36 cpe:/a:sun:jdk:1.4.2_37 cpe:/a:sun:jdk:1.5.0 cpe:/a:sun:jdk:1.5.0:update1 cpe:/a:sun:jdk:1.5.0:update10 cpe:/a:sun:jdk:1.5.0:update11 cpe:/a:sun:jdk:1.5.0:update11_b03 cpe:/a:sun:jdk:1.5.0:update12 cpe:/a:sun:jdk:1.5.0:update13 cpe:/a:sun:jdk:1.5.0:update14 cpe:/a:sun:jdk:1.5.0:update15 cpe:/a:sun:jdk:1.5.0:update16 cpe:/a:sun:jdk:1.5.0:update17 cpe:/a:sun:jdk:1.5.0:update18 cpe:/a:sun:jdk:1.5.0:update19 cpe:/a:sun:jdk:1.5.0:update2 cpe:/a:sun:jdk:1.5.0:update20 cpe:/a:sun:jdk:1.5.0:update21 cpe:/a:sun:jdk:1.5.0:update22 cpe:/a:sun:jdk:1.5.0:update23 cpe:/a:sun:jdk:1.5.0:update24 cpe:/a:sun:jdk:1.5.0:update25 cpe:/a:sun:jdk:1.5.0:update26 cpe:/a:sun:jdk:1.5.0:update27 cpe:/a:sun:jdk:1.5.0:update28 cpe:/a:sun:jdk:1.5.0:update29 cpe:/a:sun:jdk:1.5.0:update3 cpe:/a:sun:jdk:1.5.0:update31 cpe:/a:sun:jdk:1.5.0:update33 cpe:/a:sun:jdk:1.5.0:update4 cpe:/a:sun:jdk:1.5.0:update5 cpe:/a:sun:jdk:1.5.0:update6 cpe:/a:sun:jdk:1.5.0:update7 cpe:/a:sun:jdk:1.5.0:update7_b03 cpe:/a:sun:jdk:1.5.0:update8 cpe:/a:sun:jdk:1.5.0:update9 cpe:/a:sun:jdk:1.6.0 cpe:/a:sun:jdk:1.6.0:update1 cpe:/a:sun:jdk:1.6.0:update1_b06 cpe:/a:sun:jdk:1.6.0:update2 cpe:/a:sun:jdk:1.6.0:update_10 cpe:/a:sun:jdk:1.6.0:update_11 cpe:/a:sun:jdk:1.6.0:update_12 cpe:/a:sun:jdk:1.6.0:update_13 cpe:/a:sun:jdk:1.6.0:update_14 cpe:/a:sun:jdk:1.6.0:update_15 cpe:/a:sun:jdk:1.6.0:update_16 cpe:/a:sun:jdk:1.6.0:update_17 cpe:/a:sun:jdk:1.6.0:update_18 cpe:/a:sun:jdk:1.6.0:update_19 cpe:/a:sun:jdk:1.6.0:update_20 cpe:/a:sun:jdk:1.6.0:update_21 cpe:/a:sun:jdk:1.6.0:update_3 cpe:/a:sun:jdk:1.6.0:update_4 cpe:/a:sun:jdk:1.6.0:update_5 cpe:/a:sun:jdk:1.6.0:update_6 cpe:/a:sun:jdk:1.6.0:update_7 cpe:/a:sun:jre:1.4.2 cpe:/a:sun:jre:1.4.2_1 cpe:/a:sun:jre:1.4.2_2 cpe:/a:sun:jre:1.4.2_3 cpe:/a:sun:jre:1.4.2_4 cpe:/a:sun:jre:1.4.2_5 cpe:/a:sun:jre:1.4.2_6 cpe:/a:sun:jre:1.4.2_7 cpe:/a:sun:jre:1.4.2_8 cpe:/a:sun:jre:1.4.2_9 cpe:/a:sun:jre:1.4.2_10 cpe:/a:sun:jre:1.4.2_11 cpe:/a:sun:jre:1.4.2_12 cpe:/a:sun:jre:1.4.2_13 cpe:/a:sun:jre:1.4.2_14 cpe:/a:sun:jre:1.4.2_15 cpe:/a:sun:jre:1.4.2_16 cpe:/a:sun:jre:1.4.2_17 cpe:/a:sun:jre:1.4.2_18 cpe:/a:sun:jre:1.4.2_19 cpe:/a:sun:jre:1.4.2_20 cpe:/a:sun:jre:1.4.2_21 cpe:/a:sun:jre:1.4.2_22 cpe:/a:sun:jre:1.4.2_23 cpe:/a:sun:jre:1.4.2_24 cpe:/a:sun:jre:1.4.2_25 cpe:/a:sun:jre:1.4.2_26 cpe:/a:sun:jre:1.4.2_27 cpe:/a:sun:jre:1.4.2_28 cpe:/a:sun:jre:1.4.2_29 cpe:/a:sun:jre:1.4.2_30 cpe:/a:sun:jre:1.4.2_31 cpe:/a:sun:jre:1.4.2_32 cpe:/a:sun:jre:1.4.2_33 cpe:/a:sun:jre:1.4.2_34 cpe:/a:sun:jre:1.4.2_35 cpe:/a:sun:jre:1.4.2_36 cpe:/a:sun:jre:1.4.2_37 cpe:/a:sun:jre:1.5.0 cpe:/a:sun:jre:1.5.0:update1 cpe:/a:sun:jre:1.5.0:update10 cpe:/a:sun:jre:1.5.0:update11 cpe:/a:sun:jre:1.5.0:update12 cpe:/a:sun:jre:1.5.0:update13 cpe:/a:sun:jre:1.5.0:update14 cpe:/a:sun:jre:1.5.0:update15 cpe:/a:sun:jre:1.5.0:update16 cpe:/a:sun:jre:1.5.0:update17 cpe:/a:sun:jre:1.5.0:update18 cpe:/a:sun:jre:1.5.0:update19 cpe:/a:sun:jre:1.5.0:update2 cpe:/a:sun:jre:1.5.0:update20 cpe:/a:sun:jre:1.5.0:update21 cpe:/a:sun:jre:1.5.0:update22 cpe:/a:sun:jre:1.5.0:update23 cpe:/a:sun:jre:1.5.0:update24 cpe:/a:sun:jre:1.5.0:update25 cpe:/a:sun:jre:1.5.0:update26 cpe:/a:sun:jre:1.5.0:update27 cpe:/a:sun:jre:1.5.0:update28 cpe:/a:sun:jre:1.5.0:update29 cpe:/a:sun:jre:1.5.0:update3 cpe:/a:sun:jre:1.5.0:update31 cpe:/a:sun:jre:1.5.0:update33 cpe:/a:sun:jre:1.5.0:update4 cpe:/a:sun:jre:1.5.0:update5 cpe:/a:sun:jre:1.5.0:update6 cpe:/a:sun:jre:1.5.0:update7 cpe:/a:sun:jre:1.5.0:update8 cpe:/a:sun:jre:1.5.0:update9 cpe:/a:sun:jre:1.6.0 cpe:/a:sun:jre:1.6.0:update_1 cpe:/a:sun:jre:1.6.0:update_10 cpe:/a:sun:jre:1.6.0:update_11 cpe:/a:sun:jre:1.6.0:update_12 cpe:/a:sun:jre:1.6.0:update_13 cpe:/a:sun:jre:1.6.0:update_14 cpe:/a:sun:jre:1.6.0:update_15 cpe:/a:sun:jre:1.6.0:update_16 cpe:/a:sun:jre:1.6.0:update_17 cpe:/a:sun:jre:1.6.0:update_18 cpe:/a:sun:jre:1.6.0:update_19 cpe:/a:sun:jre:1.6.0:update_2 cpe:/a:sun:jre:1.6.0:update_20 cpe:/a:sun:jre:1.6.0:update_21 cpe:/a:sun:jre:1.6.0:update_3 cpe:/a:sun:jre:1.6.0:update_4 cpe:/a:sun:jre:1.6.0:update_5 cpe:/a:sun:jre:1.6.0:update_6 cpe:/a:sun:jre:1.6.0:update_7 cpe:/a:sun:jre:1.6.0:update_9

CVE-2013-0424

2013-02-01T19:55:01.553-05:00

2017-09-18T21:35:39.370-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e173569e1e7 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57715 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=906813 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.

CVE-2013-0425

2013-02-01T19:55:01.600-05:00

2017-09-18T21:35:39.527-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907344 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57709 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.

CVE-2013-0426

2013-02-01T19:55:01.630-05:00

2017-09-18T21:35:39.653-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907346 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57711 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.

CVE-2013-0427

2013-02-01T19:55:01.677-05:00

2017-09-18T21:35:39.777-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907455 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/87d135824bdf SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57724 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.

CVE-2013-0428

2013-02-01T19:55:01.723-05:00

2017-09-18T21:35:39.917-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c9534e095b37 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57713 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=907207 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.

CVE-2013-0429

2013-02-01T19:55:01.757-05:00

2017-09-18T21:35:40.043-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907460 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/c1ed8145c1b8 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57710 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.

CVE-2013-0430

2013-02-01T19:55:01.803-05:00

2017-09-18T21:35:40.167-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57722 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process of the client.

cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update11 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update11 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9

CVE-2013-0431

2013-01-31T09:55:01.327-05:00

2017-09-18T21:35:40.247-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ MISC http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP HPSBMU02874 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0247 FULLDISC 20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable FULLDISC 20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable GENTOO GLSA-201406-32 MISC http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BUGTRAQ 20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

CVE-2013-0432

2013-02-01T19:55:01.833-05:00

2017-09-18T21:35:40.357-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907219 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/e46d557465da SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57727 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."

CVE-2013-0433

2013-02-01T19:55:01.880-05:00

2017-09-18T21:35:40.480-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ab011765c4e8 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57719 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=907456 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.

CVE-2013-0434

2013-02-01T19:55:01.927-05:00

2017-09-18T21:35:40.607-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907453 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jaxp/rev/91fcc41a0b4b SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57730 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.

CVE-2013-0435

2013-02-01T19:55:01.957-05:00

2017-09-18T21:35:40.730-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906892 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c1fa21042291 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57729 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."

cpe:/a:oracle:javafx:2.0 cpe:/a:oracle:javafx:2.0.2 cpe:/a:oracle:javafx:2.0.3 cpe:/a:oracle:javafx:2.1 cpe:/a:oracle:javafx:2.2 cpe:/a:oracle:javafx:2.2.3 cpe:/a:oracle:javafx:2.2.4

CVE-2013-0436

2013-02-01T19:55:02.007-05:00

2017-09-18T21:35:40.793-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP HPSBMU02874 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html CERT TA13-032A Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.

cpe:/a:oracle:javafx:2.0 cpe:/a:oracle:javafx:2.0.2 cpe:/a:oracle:javafx:2.0.3 cpe:/a:oracle:javafx:2.1 cpe:/a:oracle:javafx:2.2 cpe:/a:oracle:javafx:2.2.3 cpe:/a:oracle:javafx:2.2.4 cpe:/a:oracle:jdk:1.7.0 cpe:/a:oracle:jdk:1.7.0:update1 cpe:/a:oracle:jdk:1.7.0:update10 cpe:/a:oracle:jdk:1.7.0:update11 cpe:/a:oracle:jdk:1.7.0:update2 cpe:/a:oracle:jdk:1.7.0:update3 cpe:/a:oracle:jdk:1.7.0:update4 cpe:/a:oracle:jdk:1.7.0:update5 cpe:/a:oracle:jdk:1.7.0:update6 cpe:/a:oracle:jdk:1.7.0:update7 cpe:/a:oracle:jdk:1.7.0:update9 cpe:/a:oracle:jre:1.7.0 cpe:/a:oracle:jre:1.7.0:update1 cpe:/a:oracle:jre:1.7.0:update10 cpe:/a:oracle:jre:1.7.0:update11 cpe:/a:oracle:jre:1.7.0:update2 cpe:/a:oracle:jre:1.7.0:update3 cpe:/a:oracle:jre:1.7.0:update4 cpe:/a:oracle:jre:1.7.0:update5 cpe:/a:oracle:jre:1.7.0:update6 cpe:/a:oracle:jre:1.7.0:update7 cpe:/a:oracle:jre:1.7.0:update9

CVE-2013-0437

2013-02-01T19:55:02.037-05:00

2017-09-18T21:35:40.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP HPSBUX02857 HP HPSBMU02874 REDHAT RHSA-2013:0237 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVE-2013-0438

2013-02-01T19:55:02.083-05:00

2017-09-18T21:35:40.937-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57708 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

cpe:/a:oracle:javafx:2.0 cpe:/a:oracle:javafx:2.0.2 cpe:/a:oracle:javafx:2.0.3 cpe:/a:oracle:javafx:2.1 cpe:/a:oracle:javafx:2.2 cpe:/a:oracle:javafx:2.2.3 cpe:/a:oracle:javafx:2.2.4

CVE-2013-0439

2013-02-01T19:55:02.113-05:00

2017-09-18T21:35:40.997-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

CVE-2013-0440

2013-02-01T19:55:02.160-05:00

2017-09-18T21:35:41.120-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/5c1e8b779c65 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57712 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=859140 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.

CVE-2013-0441

2013-02-01T19:55:02.193-05:00

2017-09-18T21:35:41.247-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907458 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/307ddc7799c7 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57692 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."

CVE-2013-0442

2013-02-01T19:55:02.240-05:00

2017-09-18T21:35:41.417-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906899 CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57687 CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVE-2013-0443

2013-02-01T19:55:02.270-05:00

2017-09-18T21:35:41.560-04:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/496bced2d275 SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 SUSE SUSE-SU-2013:0478 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57702 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=907340 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.

CVE-2013-0444

2013-02-01T19:55:02.317-05:00

2017-09-18T21:35:41.653-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907218 CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce04db4aba39 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP HPSBMU02874 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0247 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html CERT TA13-032A CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.

CVE-2013-0445

2013-02-01T19:55:02.363-05:00

2017-09-18T21:35:41.777-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57689 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=906900 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVE-2013-0446

2013-02-01T19:55:02.397-05:00

2017-09-18T21:35:41.870-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57699 CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

cpe:/a:oracle:javafx:2.0 cpe:/a:oracle:javafx:2.0.2 cpe:/a:oracle:javafx:2.0.3 cpe:/a:oracle:javafx:2.1 cpe:/a:oracle:javafx:2.2 cpe:/a:oracle:javafx:2.2.3 cpe:/a:oracle:javafx:2.2.4

CVE-2013-0447

2013-02-01T19:55:02.443-05:00

2017-09-18T21:35:41.950-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

CVE-2013-0448

2013-02-01T19:55:02.473-05:00

2017-09-18T21:35:42.013-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBMU02874 REDHAT RHSA-2013:0237 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVE-2013-0449

2013-02-01T19:55:02.520-05:00

2017-09-18T21:35:42.077-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov HP HPSBUX02857 HP HPSBMU02874 REDHAT RHSA-2013:0237 CERT-VN VU#858729 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html CERT TA13-032A Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVE-2013-0450

2013-02-01T19:55:02.567-05:00

2017-09-18T21:35:42.183-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS CONFIRM http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e0d9f4942af SUSE openSUSE-SU-2013:0312 SUSE openSUSE-SU-2013:0377 HP HPSBUX02857 HP SSRT101156 HP HPSBMU02874 REDHAT RHSA-2013:0236 REDHAT RHSA-2013:0237 REDHAT RHSA-2013:0245 REDHAT RHSA-2013:0246 REDHAT RHSA-2013:0247 REDHAT RHSA-2013:1455 REDHAT RHSA-2013:1456 GENTOO GLSA-201406-32 CERT-VN VU#858729 MANDRIVA MDVSA-2013:095 CONFIRM http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html BID 57703 CERT TA13-032A CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=906911 CONFIRM https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.

cpe:/a:ibm:maximo_asset_management:6.2 cpe:/a:ibm:maximo_asset_management:6.2.1 cpe:/a:ibm:maximo_asset_management:6.2.2 cpe:/a:ibm:maximo_asset_management:6.2.3 cpe:/a:ibm:maximo_asset_management:6.2.4 cpe:/a:ibm:maximo_asset_management:6.2.5 cpe:/a:ibm:maximo_asset_management:6.2.6 cpe:/a:ibm:maximo_asset_management:6.2.6.1 cpe:/a:ibm:maximo_asset_management:6.2.7 cpe:/a:ibm:maximo_asset_management:6.2.8 cpe:/a:ibm:maximo_asset_management:7.1 cpe:/a:ibm:maximo_asset_management:7.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.2 cpe:/a:ibm:maximo_asset_management:7.1.1.5 cpe:/a:ibm:maximo_asset_management:7.1.1.6 cpe:/a:ibm:maximo_asset_management:7.1.1.7 cpe:/a:ibm:maximo_asset_management:7.1.1.8 cpe:/a:ibm:maximo_asset_management:7.1.1.9 cpe:/a:ibm:maximo_asset_management:7.1.1.10 cpe:/a:ibm:maximo_asset_management:7.1.1.11 cpe:/a:ibm:maximo_asset_management:7.1.1.12

CVE-2013-0451

2013-10-01T07:14:43.670-04:00

2017-08-28T21:33:01.527-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov AIXAPAR IV24726 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21651085 XF maximo-cve20130451-sql-injection(80967) SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 through 7.1.1.12 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:ibm:software_use_analysis:1.3.2 cpe:/a:ibm:tivoli_endpoint_manager:8.2

CVE-2013-0452

2013-03-29T12:08:58.597-04:00

2017-08-28T21:33:01.603-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR IV38145 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631350 XF tem-sua-csrf(80968) Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack the authentication of arbitrary users via a web site that contains crafted Flash Action Message Format (AMF) messages.

cpe:/a:ibm:tivoli_endpoint_manager:8.0 cpe:/a:ibm:tivoli_endpoint_manager:8.1 cpe:/a:ibm:tivoli_endpoint_manager:8.2

CVE-2013-0453

2013-03-21T16:55:01.927-04:00

2017-08-28T21:33:01.667-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21631351 AIXAPAR IV37766 XF tem-web-reports-xss(80969) Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:storwize:v7000:1.3 cpe:/a:ibm:storwize:v7000:1.4 cpe:/a:samba:samba:3.6.0 cpe:/a:samba:samba:3.6.1 cpe:/a:samba:samba:3.6.2 cpe:/a:samba:samba:3.6.3 cpe:/a:samba:samba:3.6.4 cpe:/a:samba:samba:3.6.5 cpe:/o:canonical:ubuntu_linux:12.04:-:lts

CVE-2013-0454

2013-03-26T17:55:01.100-04:00

2017-08-28T21:33:01.747-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=ssg1S1004289 UBUNTU USN-1802-1 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=928419 MISC https://bugzilla.samba.org/show_bug.cgi?id=8738 XF storwize-cifs-incorrect-permissions(80970) MLIST [samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download CONFIRM https://www.samba.org/samba/security/CVE-2013-0454 The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.

cpe:/a:ibm:sterling_b2b_integrator:5.2.4 cpe:/a:ibm:sterling_file_gateway:-

CVE-2013-0455

2013-07-02T10:12:45.423-04:00

2013-10-10T14:33:41.443-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-10-10T13:31:56.263-04:00

AIXAPAR IC92888 Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2.4 and Sterling File Gateway allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0456

2013-07-03T09:54:30.950-04:00

2017-08-28T21:33:01.807-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130456-hijack(80972) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to hijack sessions via a modified cookie path.

cpe:/a:ibm:maximo_asset_management:7.5.0.0 cpe:/a:ibm:maximo_asset_management_essentials:7.5.0.0 cpe:/a:ibm:smartcloud_control_desk:7.5.0.0

CVE-2013-0457

2013-02-20T07:09:22.630-05:00

2017-08-28T21:33:01.870-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IV20590 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21625624 XF mam-uisessionid-xss(81011) Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a uisessionid.

cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45 cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0458

2013-01-27T13:55:02.710-05:00

2017-08-28T21:33:01.947-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21622444 AIXAPAR PM71139 XF was-admin-login-xss(81012) Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-0459

2013-01-27T13:55:02.773-05:00

2017-08-28T21:33:02.027-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21622444 AIXAPAR PM72536 XF was-admin-type-xss(81013) Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-0460

2013-01-27T13:55:02.820-05:00

2017-08-28T21:33:02.073-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21622444 AIXAPAR PM72275 XF was-admin-portlet-csrf(81014) Cross-site request forgery (CSRF) vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.

CVE-2013-0461

2013-01-27T13:55:02.867-05:00

2017-08-28T21:33:02.150-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21622444 AIXAPAR PM71389 XF was-admin-vmm-xss(81015) Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.0

CVE-2013-0462

2013-01-27T13:55:02.913-05:00

2013-01-30T00:00:00.000-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-01-28T13:21:00.000-05:00

CONFIRM http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerabilities_fixed_in_ibm_websphere_application_server_7_0_0_2785 Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0463

2013-07-03T09:54:30.957-04:00

2017-08-28T21:33:02.197-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130463-infodisc(81017) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.

cpe:/a:ibm:eclipse_help_system:3.4.3 cpe:/a:ibm:eclipse_help_system:3.6.2 cpe:/a:ibm:spss_data_collection:6.0 cpe:/a:ibm:spss_data_collection:6.0.1 cpe:/a:ibm:spss_data_collection:7.0

CVE-2013-0464

2013-06-03T19:55:00.890-04:00

2017-08-28T21:33:02.260-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 60246 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21637954 XF iehs-cve20130464-xss(81060) Multiple cross-site scripting (XSS) vulnerabilities in IBM Eclipse Help System (IEHS) 3.4.3 and 3.6.2, as used in IBM SPSS Data Collection 6.0, 6.0.1, and 7.0, allow remote attackers to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.0.0.0 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.0 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.1 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.2 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.3 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.6 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.9 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.1.0.12 cpe:/a:ibm:webshere_cast_iron_cloud_integration:6.3.0.0 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.0.0.0 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.0 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.1 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.2 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.3 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.6 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.9 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.1.0.12 cpe:/h:ibm:webshere_cast_iron_cloud_integration:6.3.0.0

CVE-2013-0465

2013-02-22T15:55:01.097-05:00

2017-08-28T21:33:02.353-04:00

5.4

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR LI77155 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21623324 XF was-castiron-security-bypass(81061) Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.

cpe:/a:ibm:websphere_message_broker:7.0. cpe:/a:ibm:websphere_message_broker:7.0.0.1 cpe:/a:ibm:websphere_message_broker:7.0.0.2 cpe:/a:ibm:websphere_message_broker:7.0.0.3 cpe:/a:ibm:websphere_message_broker:7.0.0.4 cpe:/a:ibm:websphere_message_broker:7.0.0.5 cpe:/a:ibm:websphere_message_broker:8.0 cpe:/a:ibm:websphere_message_broker:8.0.0.1

CVE-2013-0466

2013-02-20T07:09:22.677-05:00

2017-08-28T21:33:02.417-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC89383 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21623316 XF wmb-wsdl-xss(81062) Cross-site scripting (XSS) vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of an error message.

cpe:/a:ibm:data_studio:3.1.0 cpe:/a:ibm:data_studio:3.1.1

CVE-2013-0467

2013-02-20T20:55:02.077-05:00

2017-08-28T21:33:02.497-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21625573 XF iehs-source-disclosure(81102) IBM Eclipse Help System (IEHS), as used in IBM Data Studio 3.1 and 3.1.1 and other products, allows remote authenticated users to read source code via a crafted URL.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0468

2013-07-03T09:54:30.967-04:00

2017-08-28T21:33:02.557-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130468-xss(81334) Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-2983.

cpe:/h:ibm:netezza_performance_portal:1.0.2

CVE-2013-0470

2013-04-05T12:55:01.607-04:00

2017-08-28T21:33:02.620-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631945 XF netezza-cve20130470-info-disclosure(81336) HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files.

cpe:/a:ibm:tivoli_storage_manager:3.1.0 cpe:/a:ibm:tivoli_storage_manager:3.2.1 cpe:/a:ibm:tivoli_storage_manager:4.2 cpe:/a:ibm:tivoli_storage_manager:4.2.1 cpe:/a:ibm:tivoli_storage_manager:4.2.2 cpe:/a:ibm:tivoli_storage_manager:4.2.3 cpe:/a:ibm:tivoli_storage_manager:4.2.4 cpe:/a:ibm:tivoli_storage_manager:5.1.0 cpe:/a:ibm:tivoli_storage_manager:5.1.1 cpe:/a:ibm:tivoli_storage_manager:5.1.5 cpe:/a:ibm:tivoli_storage_manager:5.1.6 cpe:/a:ibm:tivoli_storage_manager:5.1.7 cpe:/a:ibm:tivoli_storage_manager:5.1.8 cpe:/a:ibm:tivoli_storage_manager:5.1.9 cpe:/a:ibm:tivoli_storage_manager:5.1.10 cpe:/a:ibm:tivoli_storage_manager:5.2 cpe:/a:ibm:tivoli_storage_manager:5.2.0 cpe:/a:ibm:tivoli_storage_manager:5.2.1 cpe:/a:ibm:tivoli_storage_manager:5.2.2 cpe:/a:ibm:tivoli_storage_manager:5.2.4 cpe:/a:ibm:tivoli_storage_manager:5.2.5.1 cpe:/a:ibm:tivoli_storage_manager:5.2.5.2 cpe:/a:ibm:tivoli_storage_manager:5.2.5.3 cpe:/a:ibm:tivoli_storage_manager:5.2.7 cpe:/a:ibm:tivoli_storage_manager:5.2.8 cpe:/a:ibm:tivoli_storage_manager:5.2.9 cpe:/a:ibm:tivoli_storage_manager:5.3 cpe:/a:ibm:tivoli_storage_manager:5.3.0 cpe:/a:ibm:tivoli_storage_manager:5.3.1 cpe:/a:ibm:tivoli_storage_manager:5.3.2 cpe:/a:ibm:tivoli_storage_manager:5.3.2.4 cpe:/a:ibm:tivoli_storage_manager:5.3.3 cpe:/a:ibm:tivoli_storage_manager:5.3.4 cpe:/a:ibm:tivoli_storage_manager:5.3.5.1 cpe:/a:ibm:tivoli_storage_manager:5.3.6.1 cpe:/a:ibm:tivoli_storage_manager:5.3.6.2 cpe:/a:ibm:tivoli_storage_manager:5.3.6.3 cpe:/a:ibm:tivoli_storage_manager:5.3.6.4 cpe:/a:ibm:tivoli_storage_manager:5.3.6.5 cpe:/a:ibm:tivoli_storage_manager:5.3.6.6 cpe:/a:ibm:tivoli_storage_manager:5.4 cpe:/a:ibm:tivoli_storage_manager:5.4.0 cpe:/a:ibm:tivoli_storage_manager:5.4.1 cpe:/a:ibm:tivoli_storage_manager:5.4.2 cpe:/a:ibm:tivoli_storage_manager:5.4.2.2 cpe:/a:ibm:tivoli_storage_manager:5.4.2.3 cpe:/a:ibm:tivoli_storage_manager:5.4.2.4 cpe:/a:ibm:tivoli_storage_manager:5.4.3.0 cpe:/a:ibm:tivoli_storage_manager:5.4.3.2 cpe:/a:ibm:tivoli_storage_manager:5.4.3.3 cpe:/a:ibm:tivoli_storage_manager:5.4.4.0 cpe:/a:ibm:tivoli_storage_manager:5.5.0 cpe:/a:ibm:tivoli_storage_manager:5.5.1 cpe:/a:ibm:tivoli_storage_manager:5.5.2 cpe:/a:ibm:tivoli_storage_manager:6.0 cpe:/a:ibm:tivoli_storage_manager:6.1.0 cpe:/a:ibm:tivoli_storage_manager:6.1.1 cpe:/a:ibm:tivoli_storage_manager:6.1.2 cpe:/a:ibm:tivoli_storage_manager:6.1.3 cpe:/a:ibm:tivoli_storage_manager:6.2.0 cpe:/a:ibm:tivoli_storage_manager:6.2.0.0 cpe:/a:ibm:tivoli_storage_manager:6.2.1 cpe:/a:ibm:tivoli_storage_manager:6.2.4.4 cpe:/a:ibm:tivoli_storage_manager:6.3.0.0 cpe:/a:ibm:tivoli_storage_manager:6.4.0.0

CVE-2013-0471

2013-02-20T23:35:51.907-05:00

2017-08-28T21:33:02.697-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR IC87331 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21624135 XF tsm-scheduler-dos(81215) The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.

CVE-2013-0472

2013-02-20T23:35:52.983-05:00

2017-08-28T21:33:02.777-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR IC87210 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21624118 XF tsm-gui-unauth-access(81216) The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access, and consequently obtain unspecified server access, via unknown vectors.

cpe:/a:ibm:rational_policy_tester:5.6.0.0 cpe:/a:ibm:rational_policy_tester:8.0.0.0 cpe:/a:ibm:rational_policy_tester:8.0.0.1 cpe:/a:ibm:rational_policy_tester:8.0.0.2 cpe:/a:ibm:rational_policy_tester:8.0.1.0 cpe:/a:ibm:rational_policy_tester:8.0.1.1 cpe:/a:ibm:rational_policy_tester:8.5.0.0 cpe:/a:ibm:rational_policy_tester:8.5.0.1 cpe:/a:ibm:rational_policy_tester:8.5.0.2 cpe:/a:ibm:rational_policy_tester:8.5.0.3 cpe:/a:ibm:security_appscan:5.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.2:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.11:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.2:-:enterprise

CVE-2013-0473

2013-03-29T12:08:58.623-04:00

2017-08-28T21:33:02.823-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631304 XF appscan-cve20130473-xss(81337) Multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow remote attackers to inject arbitrary web script or HTML via a crafted report.

CVE-2013-0474

2013-03-29T12:09:00.527-04:00

2017-08-28T21:33:02.887-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631304 XF appscan-manual-explore-csrf(81338) The Manual Explore browser plug-in in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to discover test Platform Authentication credentials via a crafted web site.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0475

2013-07-03T09:54:30.977-04:00

2017-08-28T21:33:02.933-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130475-infodisc(81403) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0567.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0476

2013-07-03T09:54:30.983-04:00

2017-08-28T21:33:02.997-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130476-ftp(81405) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors.

cpe:/a:ibm:infosphere_master_data_management_collaboration_server:10.0.0 cpe:/a:ibm:infosphere_master_data_management_collaboration_server:10.0.1 cpe:/a:ibm:infosphere_master_data_management_server_for_product_information_management:6.0.0 cpe:/a:ibm:infosphere_master_data_management_server_for_product_information_management:9.0.0 cpe:/a:ibm:infosphere_master_data_management_server_for_product_information_management:9.1.0

CVE-2013-0477

2013-02-20T20:55:02.140-05:00

2017-08-28T21:33:03.043-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21624952 XF mdm-web-content-spoofing(81481) Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allow remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.

CVE-2013-0478

2013-02-20T20:55:02.217-05:00

2017-08-28T21:33:03.107-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21624952 XF mdm-web-xss(81482) Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0479

2013-07-03T09:54:30.990-04:00

2017-08-28T21:33:03.150-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130479-filehandling(81547) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass intended access restrictions via a crafted filename.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0481

2013-07-03T09:54:31.020-04:00

2017-08-28T21:33:03.213-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627986 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-ui-info-disclosure(81546) The console in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to read stack traces by triggering (1) an error or (2) an exception.

cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.10 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.12 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.14 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.16 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.18 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.22 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.24 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1 cpe:/a:ibm:websphere_message_broker:6.1 cpe:/a:ibm:websphere_message_broker:7.0. cpe:/a:ibm:websphere_message_broker:7.0.0.1 cpe:/a:ibm:websphere_message_broker:7.0.0.2 cpe:/a:ibm:websphere_message_broker:7.0.0.3 cpe:/a:ibm:websphere_message_broker:7.0.0.4 cpe:/a:ibm:websphere_message_broker:7.0.0.5 cpe:/a:ibm:websphere_message_broker:8.0 cpe:/a:ibm:websphere_message_broker:8.0.0.1 cpe:/a:ibm:websphere_message_broker:8.0.0.2

CVE-2013-0482

2013-05-29T10:29:09.870-04:00

2017-08-28T21:33:03.277-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC88185 AIXAPAR PM76582 AIXAPAR PM86026 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21634646 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635474 XF was-wssecurity-spoofing(81548) IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489.

cpe:/a:ibm:ims_enterprise_suite:1.1 cpe:/a:ibm:ims_enterprise_suite:2.1 cpe:/a:ibm:ims_enterprise_suite:2.2

CVE-2013-0483

2013-04-05T12:55:01.627-04:00

2017-08-28T21:33:03.323-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631537 XF ims-insecure-login(81533) The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.

cpe:/a:ibm:cognos_tm1:10.1.0 cpe:/a:ibm:cognos_tm1:10.1.0.1 cpe:/a:ibm:cognos_tm1:10.1.1

CVE-2013-0484

2013-06-19T09:39:24.873-04:00

2017-08-28T21:33:03.400-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21637655 XF tm1-undocumented-api(81612) The server process in IBM Cognos TM1 10.1.x before 10.1.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via an undocumented API call that triggers the transmission of unexpected data.

cpe:/a:ibm:java:1.4.2 cpe:/a:ibm:java:5.0.0.0 cpe:/a:ibm:java:6.0.0.0 cpe:/a:ibm:java:7.0.0.0

CVE-2013-0485

2014-01-21T13:55:09.257-05:00

2016-05-25T11:34:53.860-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-05-24T15:14:48.310-04:00

SUSE SUSE-SU-2013:0701 CONFIRM http://www.ibm.com/developerworks/java/jdk/aix/142_64/fixes.html#SR13FP16 CONFIRM http://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.html#SR16FP1 CONFIRM http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64.fixes.html#SR13FP1 CONFIRM http://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR4FP1 MISC https://bugzilla.redhat.com/show_bug.cgi?id=950072 Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown impact and attack vectors related to Class Libraries.

cpe:/a:ibm:lotus_domino:8.5.0 cpe:/a:ibm:lotus_domino:8.5.0.1 cpe:/a:ibm:lotus_domino:8.5.1 cpe:/a:ibm:lotus_domino:8.5.1.1 cpe:/a:ibm:lotus_domino:8.5.1.2 cpe:/a:ibm:lotus_domino:8.5.1.3 cpe:/a:ibm:lotus_domino:8.5.1.4 cpe:/a:ibm:lotus_domino:8.5.1.5 cpe:/a:ibm:lotus_domino:8.5.2.0 cpe:/a:ibm:lotus_domino:8.5.2.1 cpe:/a:ibm:lotus_domino:8.5.2.2 cpe:/a:ibm:lotus_domino:8.5.2.3 cpe:/a:ibm:lotus_domino:8.5.2.4 cpe:/a:ibm:lotus_domino:8.5.3.0 cpe:/a:ibm:lotus_domino:8.5.3.1 cpe:/a:ibm:lotus_domino:8.5.3.2

CVE-2013-0486

2013-03-27T08:23:46.073-04:00

2017-08-28T21:33:03.463-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov JVN JVN#51305555 JVNDB JVNDB-2013-000030 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627597 XF domino-get-dos(81812) Memory leak in the HTTP server in IBM Domino 8.5.x allows remote attackers to cause a denial of service (memory consumption and daemon crash) via GET requests, aka SPR KLYH92NKZY.

CVE-2013-0487

2013-03-27T08:23:46.113-04:00

2017-08-28T21:33:03.510-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627597 XF domino-controller-auth-bypass(81852) The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.

CVE-2013-0488

2013-03-27T08:23:46.163-04:00

2017-08-28T21:33:03.557-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627597 XF domino-webadmin-xss(81853) Cross-site scripting (XSS) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-0489

2013-03-27T08:23:46.180-04:00

2017-08-28T21:33:03.620-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627597 XF domino-webadmin-csrf(81854) Cross-site request forgery (CSRF) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote authenticated users to hijack the authentication of administrators.

cpe:/a:ibm:infosphere_guardium:8.00:-:~~~z%2fos~~

CVE-2013-0490

2013-02-27T16:55:04.060-05:00

2017-08-28T21:33:03.667-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626276 XF ibm-zos-priv-esc(81948) Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors.

cpe:/a:ibm:informix_open_admin_tool:2.0 cpe:/a:ibm:informix_open_admin_tool:3.0

CVE-2013-0492

2013-08-09T19:55:02.470-04:00

2017-08-28T21:33:03.730-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21645601 XF informix-oat-cve20130492-xss(82007) Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:sterling_b2b_integrator:5.0 cpe:/a:ibm:sterling_b2b_integrator:5.1

CVE-2013-0494

2013-08-09T19:55:02.490-04:00

2017-08-28T21:33:03.777-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR IC82726 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21627989 XF sterling-b2b-byte-dos(82009) IBM Sterling B2B Integrator 5.0 and 5.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted HTTP (1) Range or (2) Request-Range header.

cpe:/h:ibm:websphere_datapower_b2b_appliance_xb62:- cpe:/h:ibm:websphere_datapower_integration_appliance_xi50:- cpe:/h:ibm:websphere_datapower_integration_appliance_xi52:- cpe:/h:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition:- cpe:/h:ibm:websphere_datapower_service_gateway_xg45:- cpe:/h:ibm:websphere_datapower_service_gateway_xg45_virtual_edition:- cpe:/h:ibm:websphere_datapower_xc10_appliance:- cpe:/o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0 cpe:/o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi50_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi50_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:5.0.0 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:3.8.2 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:4.0 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.1 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.2 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:5.0.0

CVE-2013-0499

2013-05-28T12:55:01.133-04:00

2017-08-28T21:33:03.857-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20130523 SEC Consult SA-20130523-0 :: JavaScript Execution in IBM WebSphere DataPower Services CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21637717 XF was-datapower-echo-xss(82221) MISC https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.

cpe:/a:ibm:storwize_v7000_unified_software:1.3.0.0 cpe:/a:ibm:storwize_v7000_unified_software:1.3.2.0 cpe:/a:ibm:storwize_v7000_unified_software:1.3.2.3 cpe:/a:ibm:storwize_v7000_unified_software:1.4.0.0 cpe:/a:ibm:storwize_v7000_unified_software:1.4.0.4 cpe:/a:ibm:storwize_v7000_unified_software:1.4.1.0 cpe:/a:ibm:storwize_v7000_unified_software:1.4.1.1 cpe:/h:ibm:storwize_v7000_unified:-

CVE-2013-0500

2013-10-16T20:55:03.243-04:00

2017-08-28T21:33:03.933-04:00

5.4

NETWORK

MEDIUM

MULTIPLE_INSTANCES

PARTIAL

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=ssg1S1004430 XF storwize-v7000-cve20130500-crossprotocol(84839) IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 does not properly handle device files that are created with the NFS protocol but accessed with a non-NFS protocol, which allows remote authenticated users to obtain sensitive information, modify programs or files, or cause a denial of service (device crash) via a (1) CIFS, (2) HTTPS, (3) SCP, or (4) SFTP operation.

cpe:/a:ibm:cognos_disclosure_management:10.2.0

CVE-2013-0501

2013-04-12T15:55:01.890-04:00

2017-08-28T21:33:04.010-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21627070 XF cdm-edrawsoft-activex(82345) The EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control, as used in Edraw Office Viewer Component, the client in IBM Cognos Disclosure Management (CDM) 10.2.0, and other products, allows remote attackers to read arbitrary files, or download an arbitrary program onto a client machine and execute this program, via a crafted web site.

cpe:/a:ibm:infosphere_information_server:8.1 cpe:/a:ibm:infosphere_information_server:8.5 cpe:/a:ibm:infosphere_information_server:8.5.0.1 cpe:/a:ibm:infosphere_information_server:8.5.0.2 cpe:/a:ibm:infosphere_information_server:8.5.0.3 cpe:/a:ibm:infosphere_information_server:8.7 cpe:/a:ibm:infosphere_information_server:8.7.0.1 cpe:/a:ibm:infosphere_information_server:8.7.0.2 cpe:/a:ibm:infosphere_information_server:9.1

CVE-2013-0502

2013-04-01T15:55:01.140-04:00

2017-08-28T21:33:04.057-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR JR45274 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21632556 XF infosphere-web-console-xss(82233) Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.

cpe:/a:ibm:lotus_connections:1.0.0.0 cpe:/a:ibm:lotus_connections:1.0.1.0 cpe:/a:ibm:lotus_connections:1.0.2.0 cpe:/a:ibm:lotus_connections:2.0.0.0 cpe:/a:ibm:lotus_connections:2.0.1.0 cpe:/a:ibm:lotus_connections:2.0.1.1 cpe:/a:ibm:lotus_connections:2.5.0.1 cpe:/a:ibm:lotus_connections:2.5.0.2 cpe:/a:ibm:lotus_connections:2.5.0.3 cpe:/a:ibm:lotus_connections:3.0.0.0 cpe:/a:ibm:lotus_connections:3.0.1.0 cpe:/a:ibm:lotus_connections:3.0.1.1 cpe:/a:ibm:lotus_connections:4.0.0.0

CVE-2013-0503

2013-04-23T07:47:35.903-04:00

2017-08-28T21:33:04.137-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR LO74182 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21634538 XF lotus-connections-reflected-xss(82265) Cross-site scripting (XSS) vulnerability in the Bookmarks component in IBM Lotus Connections before 4.0 CR3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:adobe:flash_player:10.3 cpe:/a:adobe:flash_player:10.3.181.14 cpe:/a:adobe:flash_player:10.3.181.16 cpe:/a:adobe:flash_player:10.3.181.22 cpe:/a:adobe:flash_player:10.3.181.23 cpe:/a:adobe:flash_player:10.3.181.26 cpe:/a:adobe:flash_player:10.3.181.34 cpe:/a:adobe:flash_player:10.3.183.5 cpe:/a:adobe:flash_player:10.3.183.7 cpe:/a:adobe:flash_player:10.3.183.10 cpe:/a:adobe:flash_player:10.3.183.11 cpe:/a:adobe:flash_player:10.3.183.15 cpe:/a:adobe:flash_player:10.3.183.16 cpe:/a:adobe:flash_player:10.3.183.18 cpe:/a:adobe:flash_player:10.3.183.19 cpe:/a:adobe:flash_player:10.3.183.20 cpe:/a:adobe:flash_player:10.3.183.23 cpe:/a:adobe:flash_player:10.3.183.25 cpe:/a:adobe:flash_player:10.3.183.29 cpe:/a:adobe:flash_player:10.3.183.43 cpe:/a:adobe:flash_player:10.3.183.48 cpe:/a:adobe:flash_player:10.3.183.50 cpe:/a:adobe:flash_player:10.3.183.51 cpe:/a:adobe:flash_player:10.3.183.61 cpe:/a:adobe:flash_player:10.3.183.63 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.6.602.167

CVE-2013-0504

2013-02-26T19:55:00.970-05:00

2018-12-06T14:27:58.713-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T12:54:13.387-05:00

SUSE openSUSE-SU-2013:0359 SUSE openSUSE-SU-2013:0360 SUSE SUSE-SU-2013:0373 REDHAT RHSA-2013:0574 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-08.html BID 58184 Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows attackers to execute arbitrary code via unspecified vectors.

CVE-2013-0505

2013-03-19T14:55:03.303-04:00

2017-08-28T21:33:04.197-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631302 XF sterling-om-xpath-injection(82339) IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.

CVE-2013-0506

2013-03-19T14:55:03.323-04:00

2017-08-28T21:33:04.247-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC90858 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631302 XF sterling-om-address-xss(82341) Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:tivoli_netcool_application_service_monitors:4.0.0 cpe:/a:ibm:tivoli_netcool_application_service_monitors:4.0.1 cpe:/a:ibm:tivoli_netcool_system_service_monitors:4.0.0 cpe:/a:ibm:tivoli_netcool_system_service_monitors:4.0.1

CVE-2013-0508

2013-06-04T23:43:32.213-04:00

2017-08-28T21:33:04.307-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21638459 XF netcool-cve20130508-config-bo(82333) Multiple buffer overflows in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 and 4.0.1 before FP1 allow context-dependent attackers to execute arbitrary code or cause a denial of service via a long line in (1) hrfstable.idx, (2) hrdevice.idx, (3) hrstorage.idx, or (4) lotusmapfile in the SSM Config directory, or (5) .manifest.hive in the main agent directory.

cpe:/a:ibm:tivoli_netcool_application_service_monitors:4.0.0 cpe:/a:ibm:tivoli_netcool_system_service_monitors:4.0.0

CVE-2013-0509

2013-06-04T23:43:48.027-04:00

2017-08-28T21:33:04.370-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21638183 XF netcool-cve20130509-mib-bo(82334) Buffer overflow in the Transaction MIB agent in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 allows remote attackers to execute arbitrary code via a SQL transaction with a long table name that is not properly handled by a packet decoder.

cpe:/a:ibm:security_appscan:5.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.2:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.11:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.2:-:enterprise

CVE-2013-0510

2013-03-29T12:09:00.583-04:00

2017-08-28T21:33:04.433-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 XF appscan-fwd-info-disclosure(82592) IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies.

CVE-2013-0511

2013-03-29T12:09:01.117-04:00

2017-08-28T21:33:04.480-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 XF appscan-cve20130511-sql-injection(82344) Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified parameters.

CVE-2013-0512

2013-03-29T12:09:03.840-04:00

2017-08-28T21:33:04.543-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631304 XF appscan-fme-dos(82593) Stack-based buffer overflow in the Manual Explore browser plug-in for Firefox in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to cause a denial of service (plug-in crash) via a crafted web page.

CVE-2013-0513

2013-03-29T12:09:03.867-04:00

2017-08-28T21:33:04.607-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631304 XF appscan-svc-path-priv-esc(82594) IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create a service that lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program, related to an "Unquoted Service Path Enumeration" vulnerability.

CVE-2013-0516

2018-07-16T21:29:00.483-04:00

2018-07-16T21:29:00.497-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

cpe:/a:ibm:sterling_secure_proxy:3.2.0.0 cpe:/a:ibm:sterling_secure_proxy:3.3.0.1 cpe:/a:ibm:sterling_secure_proxy:3.4.0.0 cpe:/a:ibm:sterling_secure_proxy:3.4.1.0 cpe:/a:ibm:sterling_secure_proxy:3.4.1.2 cpe:/a:ibm:sterling_secure_proxy:3.4.1.5 cpe:/a:ibm:sterling_secure_proxy:3.4.1.6

CVE-2013-0518

2013-05-10T07:42:29.790-04:00

2017-08-28T21:33:04.667-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21636369 XF ssp-cve20130518-content-spoofing(83128) IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2013-0519

2013-05-10T07:42:29.873-04:00

2017-08-28T21:33:04.730-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21636369 XF ssp-cve20130519-info-disclosure(82654) IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in (1) an unspecified page title and (2) an unspecified HTTP header field, which allows remote attackers to obtain potentially sensitive information by reading a version string.

CVE-2013-0520

2013-05-10T07:42:29.940-04:00

2017-08-28T21:33:04.793-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21636369 XF ssp-cve20130520-info-disclosure(83433) IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java stack-trace information by providing invalid input data.

cpe:/a:ibm:lotus_notes:8.0 cpe:/a:ibm:lotus_notes:8.0.1 cpe:/a:ibm:lotus_notes:8.0.2 cpe:/a:ibm:lotus_notes:8.5 cpe:/a:ibm:lotus_notes:8.5.1 cpe:/a:ibm:lotus_notes:8.5.2 cpe:/a:ibm:lotus_notes:8.5.3 cpe:/a:ibm:lotus_notes:9.0

CVE-2013-0522

2018-07-16T10:29:00.277-04:00

2018-09-17T13:56:48.263-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-17T13:44:42.287-04:00

XF ibm-notes-password-retrieval(82531) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21634508 The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving an unspecified operating system communication mechanism for password transmission between Windows and Notes. IBM X-Force ID: 82531.

cpe:/a:ibm:websphere_commerce:5.6.1 cpe:/a:ibm:websphere_commerce:5.6.1.1 cpe:/a:ibm:websphere_commerce:5.6.1.2 cpe:/a:ibm:websphere_commerce:5.6.1.3 cpe:/a:ibm:websphere_commerce:5.6.1.4 cpe:/a:ibm:websphere_commerce:5.6.1.5 cpe:/a:ibm:websphere_commerce:6.0.0.0 cpe:/a:ibm:websphere_commerce:6.0.0.1 cpe:/a:ibm:websphere_commerce:6.0.0.2 cpe:/a:ibm:websphere_commerce:6.0.0.3 cpe:/a:ibm:websphere_commerce:6.0.0.4 cpe:/a:ibm:websphere_commerce:6.0.0.5 cpe:/a:ibm:websphere_commerce:6.0.0.6 cpe:/a:ibm:websphere_commerce:6.0.0.7 cpe:/a:ibm:websphere_commerce:6.0.0.8 cpe:/a:ibm:websphere_commerce:6.0.0.9 cpe:/a:ibm:websphere_commerce:6.0.0.10 cpe:/a:ibm:websphere_commerce:6.0.0.11 cpe:/a:ibm:websphere_commerce:7.0 cpe:/a:ibm:websphere_commerce:7.0.0.1 cpe:/a:ibm:websphere_commerce:7.0.0.2 cpe:/a:ibm:websphere_commerce:7.0.0.3 cpe:/a:ibm:websphere_commerce:7.0.0.4 cpe:/a:ibm:websphere_commerce:7.0.0.5 cpe:/a:ibm:websphere_commerce:7.0.0.6 cpe:/a:ibm:websphere_commerce:7.0.0.7

CVE-2013-0523

2013-06-21T15:55:01.093-04:00

2019-09-30T12:19:41.927-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://www.vsecurity.com/advisory/20130619-1.txt MISC http://www.vsecurity.com/resources/advisory/20130619-1/ AIXAPAR JR46386 XF was-commerce-cve20130523-info-disclosure(82541) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21640597 IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8 processing of the krypto parameter, and leverages unspecified browser access or traffic-log access.

cpe:/a:ibm:lotus_inotes:8.5.0.0 cpe:/a:ibm:lotus_inotes:8.5.0.1 cpe:/a:ibm:lotus_inotes:8.5.1.0 cpe:/a:ibm:lotus_inotes:8.5.1.1 cpe:/a:ibm:lotus_inotes:8.5.1.2 cpe:/a:ibm:lotus_inotes:8.5.1.3 cpe:/a:ibm:lotus_inotes:8.5.1.4 cpe:/a:ibm:lotus_inotes:8.5.1.5 cpe:/a:ibm:lotus_inotes:8.5.2.0 cpe:/a:ibm:lotus_inotes:8.5.2.1 cpe:/a:ibm:lotus_inotes:8.5.2.2 cpe:/a:ibm:lotus_inotes:8.5.2.3 cpe:/a:ibm:lotus_inotes:8.5.3.0 cpe:/a:ibm:lotus_inotes:8.5.3.1 cpe:/a:ibm:lotus_inotes:8.5.3.2

CVE-2013-0525

2013-03-26T17:55:01.123-04:00

2017-08-28T21:33:04.917-04:00

1.5

LOCAL

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21628658 XF inotes-folder-xss(82542) Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a shared mail file, aka SPR DKEN8PDNTX.

cpe:/o:ibm:global_console_manager_16_firmware:1.18.0.22011 cpe:/o:ibm:global_console_manager_32_firmware:1.18.0.22011

CVE-2013-0526

2013-08-21T12:55:07.417-04:00

2017-08-28T21:33:04.980-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov MISC http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html CONFIRM http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509 XF gcm-cve20130526-command-exec(85367) ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) count or (2) size parameter.

cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.0 cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.2 cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.3 cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.6 cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.7 cpe:/a:ibm:sterling_connect_direct_user_interface:1.4.0.10 cpe:/a:ibm:sterling_connect_direct_user_interface:1.5.0.0 cpe:/a:ibm:sterling_connect_direct_user_interface:1.5.0.1

CVE-2013-0527

2013-06-21T10:55:01.050-04:00

2017-08-28T21:33:05.043-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC90479 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640356 XF sterling-cve20130527-info-disclosure(82609) The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not close pages upon the timeout of a session, which allows physically proximate attackers to obtain sensitive administrative-console information by reading the screen of an unattended workstation.

CVE-2013-0528

2018-07-16T21:29:00.530-04:00

2018-07-16T21:29:00.560-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0529

2013-06-21T10:55:01.080-04:00

2017-08-28T21:33:05.120-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC90478 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640356 XF sterling-cve20130529-info-disclosure(82611) The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

cpe:/a:ibm:security_appscan:5.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:6.0.0.0:-:enterprise cpe:/a:ibm:security_appscan:6.0.1.0:-:enterprise cpe:/a:ibm:security_appscan:6.0.2.0:-:enterprise cpe:/a:ibm:security_appscan:6.1.1.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.0.2:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.0:-:enterprise cpe:/a:ibm:security_appscan:8.0.1.1:-:enterprise cpe:/a:ibm:security_appscan:8.0.11:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.5.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.0:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.1:-:enterprise cpe:/a:ibm:security_appscan:8.6.0.2:-:enterprise cpe:/a:ibm:security_appscan:8.7.0.0:-:enterprise

CVE-2013-0531

2013-09-08T12:55:06.553-04:00

2017-08-28T21:33:05.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640352 XF appscan-cve20130531-weak-ciphersuites(84707) The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

CVE-2013-0532

2013-03-29T12:09:03.893-04:00

2017-08-28T21:33:05.293-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21626264 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21631304 XF appscan-cve20130532-csrf(82595) Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that cause a denial of service via malformed HTTP data.

cpe:/a:ibm:lotus_sametime:8.0.2 cpe:/a:ibm:lotus_sametime:8.0.2.1 cpe:/a:ibm:lotus_sametime:8.5 cpe:/a:ibm:lotus_sametime:8.5.1 cpe:/a:ibm:lotus_sametime:8.5.1.1 cpe:/a:ibm:lotus_sametime:8.5.2 cpe:/a:ibm:lotus_sametime:8.5.2.1

CVE-2013-0533

2013-04-27T23:24:14.760-04:00

2017-08-28T21:33:05.370-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633620 XF inotes-webmail-xss(82655) Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:lotus_sametime:8.5.1 cpe:/a:ibm:lotus_sametime:8.5.1.1 cpe:/a:ibm:lotus_sametime:8.5.1.2 cpe:/a:ibm:lotus_sametime:8.5.2 cpe:/a:ibm:lotus_sametime:8.5.2.1 cpe:/a:ibm:sametime:8.5.1 cpe:/a:ibm:sametime:8.5.1.1 cpe:/a:ibm:sametime:8.5.1.2 cpe:/a:ibm:sametime:8.5.2 cpe:/a:ibm:sametime:8.5.2.1

CVE-2013-0534

2013-06-21T10:55:01.107-04:00

2017-08-28T21:33:05.417-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635218 XF notes-cve20130534-info-disclosure(82656) The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.

cpe:/a:ibm:classic_meeting_server:7.5.1.2 cpe:/a:ibm:classic_meeting_server:8.0.1 cpe:/a:ibm:classic_meeting_server:8.0.2 cpe:/a:ibm:classic_meeting_server:8.5 cpe:/a:ibm:classic_meeting_server:8.5.1.2 cpe:/a:ibm:classic_meeting_server:8.5.2.1 cpe:/a:ibm:lotus_sametime:7.5.1.2 cpe:/a:ibm:lotus_sametime:8.0 cpe:/a:ibm:lotus_sametime:8.0.1 cpe:/a:ibm:lotus_sametime:8.0.1.1 cpe:/a:ibm:lotus_sametime:8.0.2 cpe:/a:ibm:lotus_sametime:8.0.2.1 cpe:/a:ibm:lotus_sametime:8.5 cpe:/a:ibm:lotus_sametime:8.5.1 cpe:/a:ibm:lotus_sametime:8.5.1.1 cpe:/a:ibm:lotus_sametime:8.5.2 cpe:/a:ibm:lotus_sametime:8.5.2.1

CVE-2013-0535

2013-05-02T14:55:00.977-04:00

2017-08-28T21:33:05.480-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635185 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635545 XF sametime-meeting-multiple-xss(82657) Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:lotus_inotes:8.5.2.0 cpe:/a:ibm:lotus_inotes:8.5.3.0 cpe:/a:ibm:lotus_notes:8.0 cpe:/a:ibm:lotus_notes:8.0.1 cpe:/a:ibm:lotus_notes:8.0.2 cpe:/a:ibm:lotus_notes:8.5 cpe:/a:ibm:lotus_notes:8.5.1 cpe:/a:ibm:lotus_notes_traveler:9.0

CVE-2013-0536

2013-06-21T13:55:01.107-04:00

2017-08-28T21:33:05.527-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633827 XF notes-cve20130536-code-exec(82658) ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J24.

cpe:/a:ibm:lotus_sametime:8.5.2 cpe:/a:ibm:lotus_sametime:8.5.2.1

CVE-2013-0537

2013-11-08T20:55:04.390-05:00

2017-08-28T21:33:05.590-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21654355 XF sametime-ems-cve20130537-spoof(84840) The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges.

CVE-2013-0538

2013-05-01T08:00:07.873-04:00

2017-08-28T21:33:05.650-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CERT-VN VU#912420 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633819 XF ibm-notes-javascript-tags(83270) Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0539

2013-07-03T09:54:31.030-04:00

2017-08-28T21:33:05.697-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC92007 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130539-sessionid(82916) An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack.

cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile

CVE-2013-0540

2013-04-24T06:28:37.470-04:00

2017-08-28T21:33:05.747-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM81056 XF was-ssl-sec-bypass(82695) IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.

cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0541

2013-04-24T06:28:37.497-04:00

2017-08-28T21:33:05.823-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM74909 XF was-cve20130541-dos(82696) Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger (WIM), allows local users to cause a denial of service (daemon crash) via unspecified vectors.

cpe:/a:ibm:websphere_application_server:6.1.0 cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0542

2013-04-24T06:28:37.523-04:00

2017-08-28T21:33:05.900-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM81846 XF was-cve20130542-xss(82697) Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.

cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0543

2013-04-24T06:28:37.547-04:00

2017-08-28T21:33:05.980-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM75582 XF was-cve20130543-sec-bypass(82759) IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0544

2013-04-24T06:28:37.570-04:00

2017-08-28T21:33:06.057-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM82468 XF was-cve20130544-dir-traversal(82760) Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.

cpe:/a:ibm:application_manager_for_smart_business:1.2.1 cpe:/a:ibm:tivoli_monitoring:6.2.0 cpe:/a:ibm:tivoli_monitoring:6.2.0.1 cpe:/a:ibm:tivoli_monitoring:6.2.0.2 cpe:/a:ibm:tivoli_monitoring:6.2.0.3 cpe:/a:ibm:tivoli_monitoring:6.2.1 cpe:/a:ibm:tivoli_monitoring:6.2.1.1 cpe:/a:ibm:tivoli_monitoring:6.2.1.2 cpe:/a:ibm:tivoli_monitoring:6.2.1.3 cpe:/a:ibm:tivoli_monitoring:6.2.1.4 cpe:/a:ibm:tivoli_monitoring:6.2.2 cpe:/a:ibm:tivoli_monitoring:6.2.2.1 cpe:/a:ibm:tivoli_monitoring:6.2.2.2 cpe:/a:ibm:tivoli_monitoring:6.2.2.3 cpe:/a:ibm:tivoli_monitoring:6.2.2.4 cpe:/a:ibm:tivoli_monitoring:6.2.2.5 cpe:/a:ibm:tivoli_monitoring:6.2.2.6 cpe:/a:ibm:tivoli_monitoring:6.2.2.7 cpe:/a:ibm:tivoli_monitoring:6.2.2.8 cpe:/a:ibm:tivoli_monitoring:6.2.2.9 cpe:/a:ibm:tivoli_monitoring:6.2.3 cpe:/a:ibm:tivoli_monitoring:6.2.3.1 cpe:/a:ibm:tivoli_monitoring:6.2.3.2

CVE-2013-0548

2013-06-21T13:55:01.133-04:00

2017-08-28T21:33:06.120-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IV27192 AIXAPAR IV30187 AIXAPAR IV40115 AIXAPAR IV40116 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640752 XF itm-cve20130548-xss(82767) Multiple cross-site scripting (XSS) vulnerabilities in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:websphere_portal:7.0.0.0:cf001 cpe:/a:ibm:websphere_portal:7.0.0.1 cpe:/a:ibm:websphere_portal:7.0.0.1:cf002 cpe:/a:ibm:websphere_portal:7.0.0.1:cf003 cpe:/a:ibm:websphere_portal:7.0.0.1:cf004 cpe:/a:ibm:websphere_portal:7.0.0.1:cf005 cpe:/a:ibm:websphere_portal:7.0.0.1:cf006 cpe:/a:ibm:websphere_portal:7.0.0.1:cf007 cpe:/a:ibm:websphere_portal:7.0.0.1:cf008 cpe:/a:ibm:websphere_portal:7.0.0.1:cf009 cpe:/a:ibm:websphere_portal:7.0.0.1:cf010 cpe:/a:ibm:websphere_portal:7.0.0.1:cf019 cpe:/a:ibm:websphere_portal:7.0.0.2 cpe:/a:ibm:websphere_portal:7.0.0.2:cf011 cpe:/a:ibm:websphere_portal:7.0.0.2:cf012 cpe:/a:ibm:websphere_portal:7.0.0.2:cf013 cpe:/a:ibm:websphere_portal:7.0.0.2:cf014 cpe:/a:ibm:websphere_portal:7.0.0.2:cf015 cpe:/a:ibm:websphere_portal:7.0.0.2:cf016 cpe:/a:ibm:websphere_portal:7.0.0.2:cf017 cpe:/a:ibm:websphere_portal:7.0.0.2:cf018 cpe:/a:ibm:websphere_portal:7.0.0.2:cf019 cpe:/a:ibm:websphere_portal:7.0.0.2:cf020 cpe:/a:ibm:websphere_portal:7.0.0.2:cf021 cpe:/a:ibm:websphere_portal:7.0.0.2:cf022 cpe:/a:ibm:websphere_portal:8.0 cpe:/a:ibm:websphere_portal:8.0.0.0:cf01 cpe:/a:ibm:websphere_portal:8.0.0.0:cf02 cpe:/a:ibm:websphere_portal:8.0.0.0:cf03 cpe:/a:ibm:websphere_portal:8.0.0.0:cf04 cpe:/a:ibm:websphere_portal:8.0.0.0:cf05 cpe:/a:ibm:websphere_portal:8.0.0.1 cpe:/a:ibm:websphere_portal:8.0.0.1:cf04 cpe:/a:ibm:websphere_portal:8.0.0.1:cf05

CVE-2013-0549

2013-06-03T17:55:01.627-04:00

2017-08-28T21:33:06.183-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR PM84525 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21638984 XF was-portal-cve20130549-xss(82762) Cross-site scripting (XSS) vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2013-0550

2018-07-16T21:29:00.590-04:00

2018-07-16T21:29:00.607-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0551

2013-06-21T13:55:01.163-04:00

2017-08-28T21:33:06.247-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR IV27192 AIXAPAR IV30187 AIXAPAR IV40115 AIXAPAR IV40116 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635080 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640752 XF itm-cve20130551-dos(82768) The Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to cause a denial of service (abend) via a crafted URL.

cpe:/a:ibm:lotus_sametime:8.5.1 cpe:/a:ibm:lotus_sametime:8.5.1.1 cpe:/a:ibm:sametime:8.5.2.0 cpe:/a:ibm:sametime:8.5.2.1

CVE-2013-0553

2013-04-27T23:24:14.823-04:00

2017-08-28T21:33:06.293-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633618 XF ibm-sametime-commands(82915) The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced Connect client, Sametime Advanced Web client, and other products, allows remote authenticated users to send commands to individual chat users, or to all participants in a chat room, via a crafted Sametime Instant Message (IM).

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0558

2013-07-03T09:54:31.040-04:00

2017-08-28T21:33:06.357-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC90483 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130558-infodisc(83006) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive information about application implementation via unspecified vectors.

cpe:/a:ibm:api_management:2.0.0.0

CVE-2013-0559

2013-07-19T10:36:13.007-04:00

2017-08-28T21:33:06.400-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21643847 XF apimgmt-cve20130559-unauth-access(85557) Unspecified vulnerability in IBM API Management 2.0 before 2.0.0.1 allows remote attackers to access tenant APIs, and consequently obtain sensitive information or modify data, via unknown vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0560

2013-07-03T09:54:31.047-04:00

2017-08-28T21:33:06.463-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130560-sql(83012) Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2012-5766.

cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1

CVE-2013-0565

2013-04-24T06:28:37.597-04:00

2017-08-28T21:33:06.510-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 AIXAPAR PM83402 XF was-cve20130565-xss(83138) Cross-site scripting (XSS) vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server (WAS) 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted response.

CVE-2013-0566

2013-08-26T23:34:34.903-04:00

2019-09-30T12:19:41.927-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21647750 AIXAPAR JR46776 XF wscommerce-cve20130566-xss(83139) Multiple cross-site scripting (XSS) vulnerabilities in the (1) Accelerator JSPs, (2) Organization Administration Console JSPs, and (3) Administration Console JSPs in WebSphere Commerce Tools in IBM WebSphere Commerce 5.6.1.0 through 5.6.1.5, 6.0.0.0 through 6.0.0.11, and 7.0.0.0 through 7.0.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0567

2013-07-03T09:54:31.057-04:00

2017-08-28T21:33:06.620-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC91151 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130567-infodisc(83164) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0475.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2 cpe:/a:ibm:sterling_file_gateway:2.1 cpe:/a:ibm:sterling_file_gateway:2.2

CVE-2013-0568

2013-07-03T09:54:31.063-04:00

2017-08-28T21:33:06.667-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21640830 XF sterling-b2b-cve20130568-infodisc(83165) IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0475, and CVE-2013-0567.

cpe:/a:ibm:connections:4.5.0.0

CVE-2013-0569

2013-04-26T23:16:46.823-04:00

2017-08-28T21:33:06.747-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR LO74629 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635059 XF ibm-communities-cve20130569-xss(83354) Cross-site scripting (XSS) vulnerability in the Communities component in IBM Connections 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/o:ibm:network_operating_system:-

CVE-2013-0570

2018-07-13T17:29:00.280-04:00

2018-09-10T08:50:37.617-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-07T14:26:16.337-04:00

XF ibm-networking-cve20130570(83166) CONFIRM https://www-304.ibm.com/support/docview.wss?uid=isg3T1019715 The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS, formerly BLADE Operating System) floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow remote attackers to obtain sensitive information in opportunistic circumstances by eavesdropping on the broadcast domain. IBM X-Force ID: 83166.

cpe:/a:ibm:application_support_facility:3.4.0:-:~~~aix~~ cpe:/a:ibm:application_support_facility:3.4.0:-:~~~linux_kernel~~ cpe:/a:ibm:application_support_facility:3.4.0:-:~~~windows~~ cpe:/a:ibm:application_support_facility:3.4.0:-:~~~z%2fos~~ cpe:/a:ibm:document_connect_for_application_support_facility:1.0.0.1204

CVE-2013-0571

2013-04-26T23:16:46.847-04:00

2017-08-28T21:33:06.807-04:00

2.9

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635328 XF asf-cve20130571-xss(83246) Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2013-0572

2013-04-26T23:16:46.863-04:00

2017-08-28T21:33:06.857-04:00

2.3

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635328 XF asf-cve20130572-spoofing(83247) Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.

cpe:/a:ibm:tivoli_monitoring:6.2.0 cpe:/a:ibm:tivoli_monitoring:6.2.0.1 cpe:/a:ibm:tivoli_monitoring:6.2.0.2 cpe:/a:ibm:tivoli_monitoring:6.2.0.3 cpe:/a:ibm:tivoli_monitoring:6.2.1 cpe:/a:ibm:tivoli_monitoring:6.2.1.1 cpe:/a:ibm:tivoli_monitoring:6.2.1.2 cpe:/a:ibm:tivoli_monitoring:6.2.1.3 cpe:/a:ibm:tivoli_monitoring:6.2.1.4 cpe:/a:ibm:tivoli_monitoring:6.2.2 cpe:/a:ibm:tivoli_monitoring:6.2.2.1 cpe:/a:ibm:tivoli_monitoring:6.2.2.2 cpe:/a:ibm:tivoli_monitoring:6.2.2.3 cpe:/a:ibm:tivoli_monitoring:6.2.2.4 cpe:/a:ibm:tivoli_monitoring:6.2.2.5 cpe:/a:ibm:tivoli_monitoring:6.2.2.6 cpe:/a:ibm:tivoli_monitoring:6.2.2.7 cpe:/a:ibm:tivoli_monitoring:6.2.2.8 cpe:/a:ibm:tivoli_monitoring:6.2.2.9 cpe:/a:ibm:tivoli_monitoring:6.2.3 cpe:/a:ibm:tivoli_monitoring:6.2.3.1 cpe:/a:ibm:tivoli_monitoring:6.2.3.2

CVE-2013-0576

2013-05-28T11:55:01.340-04:00

2017-08-28T21:33:06.917-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IV32812 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21634920 XF ibm-tivoli-cve20130576-xss(83328) Cross-site scripting (XSS) vulnerability in the Tivoli Enterprise Portal browser client in IBM Tivoli Monitoring 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.3.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.3.2 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.3.3 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.4.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.4.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.5.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:6.5.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.1.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.1.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.1.2 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.2.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.2.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.2.2 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.3.0 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:7.3.1 cpe:/a:ibm:infosphere_optim_data_growth_for_oracle_e-business_suite:9.1.0

CVE-2013-0577

2013-10-10T06:55:03.850-04:00

2017-08-28T21:33:06.980-04:00

5.2

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21651990 XF ibm-optim-cve20130577(83329) The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to bypass intended access restrictions and create, modify, or delete documents or scripts via unspecified vectors.

cpe:/a:ibm:sterling_multi-channel_fulfillment_solution:8.0 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:8.5 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.0 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.1 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.2 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.3 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.4 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.5 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.6 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.7 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.8 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.9 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.10 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.11 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.12 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.13 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.14 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.15 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.16 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.17 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.18 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.19 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.20 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.21 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.22 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.23 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.24 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.25 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.26 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.27 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.28 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.29 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.30 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.31 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.32 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.33 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.34 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.35 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.36 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.37 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.38 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.39 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.40 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.41 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.42 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.43 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0.44 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.1 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.2 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.3 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.4 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.5 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.6 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.7 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.8 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.9 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.10 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.11 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.12 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.13 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.14 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.15 cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0.16

CVE-2013-0578

2013-05-10T07:42:29.960-04:00

2017-08-28T21:33:07.043-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR IC91829 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21636034 XF ibm-sterling-cve20130578-info-disclosure(83330) The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8.0 before HF128 and IBM Sterling Selling and Fulfillment Foundation 8.5 before HF93, 9.0 before HF73, 9.1.0 before FP45, and 9.2.0 before FP17, when the API tester is enabled, do not require administrative credentials, which allows remote authenticated users to obtain sensitive database information via a request to the API tester URI.

CVE-2013-0579

2013-10-10T06:55:06.240-04:00

2017-08-28T21:33:07.107-04:00

4.3

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21651990 XF ibm-optim-cve20130579-session-fixation(83331) The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote attackers to impersonate arbitrary users by leveraging access to a legitimate user's web browser either (1) before or (2) after authentication.

CVE-2013-0580

2013-10-10T06:55:06.257-04:00

2017-08-28T21:33:07.167-04:00

4.9

ADJACENT_NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21651990 XF ibm-optim-cve20130580-csrf(83332) Cross-site request forgery (CSRF) vulnerability in the Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to hijack the authentication of arbitrary users.

cpe:/a:ibm:business_process_manager:7.5.1.0 cpe:/a:ibm:business_process_manager:7.5.1.1 cpe:/a:ibm:business_process_manager:8.0.0.0 cpe:/a:ibm:business_process_manager:8.0.1.0

CVE-2013-0581

2013-07-06T09:57:33.293-04:00

2017-08-28T21:33:07.247-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR JR45799 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21633593 XF bpm-cve20130581-xss(83333) Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socialPortal/dashboard.jsp, (2) teamworks/executeServiceByName, (3) portal/jsp/viewAdHocReportWizard.do, or (4) rest/bpm/wle/v1/process.

cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.1 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.2 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.3 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.8 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.9 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.10 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.0.11 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.1 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.1.1 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.1.2 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.1.3 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.1.4 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.2 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.2.2 cpe:/a:ibm:tivoli_federated_identity_manager:6.2.2.3 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.1 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.2 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.3 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.8 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.9 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.10 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0.11 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.1 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.1.3 cpe:/a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.1.4

CVE-2013-0582

2013-05-02T14:55:05.443-04:00

2013-05-03T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-05-03T10:53:00.000-04:00

AIXAPAR IV26033 AIXAPAR IV26034 AIXAPAR IV31640 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635688 Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a SAML 2.0 response.

cpe:/a:ibm:infosphere_replication_server:9.7 cpe:/a:ibm:infosphere_replication_server:10.1.0 cpe:/a:ibm:infosphere_replication_server:10.1.0.1 cpe:/a:ibm:infosphere_replication_server:10.1.0.2 cpe:/a:ibm:infosphere_replication_server:10.1.0.3 cpe:/a:ibm:infosphere_replication_server:10.1.0.4 cpe:/a:ibm:infosphere_replication_server:10.2.0.0

CVE-2013-0584

2013-04-23T07:47:35.933-04:00

2017-08-28T21:33:07.307-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21634798 XF ibm-infosphere-cve20130584-info-disclosure(83355) The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors.

cpe:/a:ibm:infosphere_information_server:8.1 cpe:/a:ibm:infosphere_information_server:8.5 cpe:/a:ibm:infosphere_information_server:8.7 cpe:/a:ibm:infosphere_information_server:9.1

CVE-2013-0585

2013-08-15T21:55:11.400-04:00

2017-08-28T21:33:07.370-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21646136 XF infosphere-cve20130585-xss(83356) Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management user interfaces.

cpe:/a:ibm:cognos_business_intelligence:8.4.1 cpe:/a:ibm:cognos_business_intelligence:10.1 cpe:/a:ibm:cognos_business_intelligence:10.1.1 cpe:/a:ibm:cognos_business_intelligence:10.2 cpe:/a:ibm:cognos_business_intelligence:10.2.1

CVE-2013-0586

2013-08-26T23:34:34.950-04:00

2017-08-28T21:33:07.433-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21645566 XF cognosbi-cve20130586-xss(83380) Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:websphere_portal:5.1.0.0 cpe:/a:ibm:websphere_portal:5.1.0.1 cpe:/a:ibm:websphere_portal:5.1.0.2 cpe:/a:ibm:websphere_portal:5.1.0.3 cpe:/a:ibm:websphere_portal:5.1.0.4 cpe:/a:ibm:websphere_portal:5.1.0.5 cpe:/a:ibm:websphere_portal:6.0.0.0 cpe:/a:ibm:websphere_portal:6.0.0.1 cpe:/a:ibm:websphere_portal:6.0.0.2 cpe:/a:ibm:websphere_portal:6.0.0.3 cpe:/a:ibm:websphere_portal:6.0.0.4 cpe:/a:ibm:websphere_portal:6.0.1.0 cpe:/a:ibm:websphere_portal:6.0.1.1 cpe:/a:ibm:websphere_portal:6.0.1.2 cpe:/a:ibm:websphere_portal:6.0.1.3 cpe:/a:ibm:websphere_portal:6.0.1.4 cpe:/a:ibm:websphere_portal:6.0.1.5 cpe:/a:ibm:websphere_portal:6.0.1.5:wp6015_008_01 cpe:/a:ibm:websphere_portal:6.0.1.6 cpe:/a:ibm:websphere_portal:6.0.1.7 cpe:/a:ibm:websphere_portal:6.1.0.0 cpe:/a:ibm:websphere_portal:6.1.0.1 cpe:/a:ibm:websphere_portal:6.1.0.2 cpe:/a:ibm:websphere_portal:6.1.0.3 cpe:/a:ibm:websphere_portal:6.1.5.0 cpe:/a:ibm:websphere_portal:7.0.0.0 cpe:/a:ibm:websphere_portal:7.0.0.0:cf001 cpe:/a:ibm:websphere_portal:7.0.0.1 cpe:/a:ibm:websphere_portal:7.0.0.1:cf002 cpe:/a:ibm:websphere_portal:7.0.0.1:cf003 cpe:/a:ibm:websphere_portal:7.0.0.1:cf004 cpe:/a:ibm:websphere_portal:7.0.0.1:cf005 cpe:/a:ibm:websphere_portal:7.0.0.1:cf006 cpe:/a:ibm:websphere_portal:7.0.0.1:cf007 cpe:/a:ibm:websphere_portal:7.0.0.1:cf008 cpe:/a:ibm:websphere_portal:7.0.0.1:cf009 cpe:/a:ibm:websphere_portal:7.0.0.1:cf010 cpe:/a:ibm:websphere_portal:7.0.0.1:cf019 cpe:/a:ibm:websphere_portal:7.0.0.2 cpe:/a:ibm:websphere_portal:7.0.0.2:cf011 cpe:/a:ibm:websphere_portal:7.0.0.2:cf012 cpe:/a:ibm:websphere_portal:7.0.0.2:cf013 cpe:/a:ibm:websphere_portal:7.0.0.2:cf014 cpe:/a:ibm:websphere_portal:7.0.0.2:cf015 cpe:/a:ibm:websphere_portal:7.0.0.2:cf016 cpe:/a:ibm:websphere_portal:7.0.0.2:cf017 cpe:/a:ibm:websphere_portal:7.0.0.2:cf018 cpe:/a:ibm:websphere_portal:7.0.0.2:cf019 cpe:/a:ibm:websphere_portal:7.0.0.2:cf020 cpe:/a:ibm:websphere_portal:7.0.0.2:cf021 cpe:/a:ibm:websphere_portal:7.0.0.2:cf022 cpe:/a:ibm:websphere_portal:8.0 cpe:/a:ibm:websphere_portal:8.0.0.0 cpe:/a:ibm:websphere_portal:8.0.0.0:cf01 cpe:/a:ibm:websphere_portal:8.0.0.0:cf02 cpe:/a:ibm:websphere_portal:8.0.0.0:cf03 cpe:/a:ibm:websphere_portal:8.0.0.0:cf04 cpe:/a:ibm:websphere_portal:8.0.0.0:cf05 cpe:/a:ibm:websphere_portal:8.0.0.1 cpe:/a:ibm:websphere_portal:8.0.0.1:cf04 cpe:/a:ibm:websphere_portal:8.0.0.1:cf05 cpe:/a:ibm:websphere_portal:8.0.0.1:cf06

CVE-2013-0587

2013-08-15T21:55:15.753-04:00

2017-08-28T21:33:07.497-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR PM90118 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21646618 XF wsportal-cve20130587-xss(84345) Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.

cpe:/a:ibm:inotes:8.0.0.0 cpe:/a:ibm:inotes:8.0.1.0 cpe:/a:ibm:inotes:8.0.2.0 cpe:/a:ibm:inotes:8.5.0.0 cpe:/a:ibm:inotes:8.5.1.0 cpe:/a:ibm:inotes:8.5.2.0 cpe:/a:ibm:inotes:8.5.3.0 cpe:/a:ibm:inotes:9.0.0.0

CVE-2013-0589

2018-07-11T12:29:00.237-04:00

2018-09-04T14:11:38.993-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-04T09:25:51.027-04:00

XF ibm-inotes-cve20130589-info-disclosure(83371) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21671622 IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM X-Force ID: 83371.

CVE-2013-0590

2013-08-26T23:34:34.970-04:00

2017-08-28T21:33:07.557-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21647740 XF inotes-cve20130590-xss(83814) Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0591.

CVE-2013-0591

2013-08-26T23:34:34.993-04:00

2017-08-28T21:33:07.620-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21647740 XF inotes-cve20130591-xss(83381) Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0590.

CVE-2013-0592

2018-07-11T12:29:00.297-04:00

2018-09-04T13:39:22.330-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-04T09:39:41.730-04:00

XF ibm-inotes-cve20130592-xss(83815) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21671622 Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 83815.

cpe:/a:ibm:spss_samplepower:3.0.0.0

CVE-2013-0593

2013-04-26T23:16:46.880-04:00

2017-08-28T21:33:07.667-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21635503 XF ibm-spss-cve20130593-code-exec(83382) Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001 allows remote attackers to execute arbitrary code via unknown vectors.

CVE-2013-0594

2018-07-11T12:29:00.347-04:00

2018-09-04T13:49:29.627-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-04T09:49:04.710-04:00

XF ibm-inotes-cve20130594-open-redirect(83383) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21671622 Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383.

CVE-2013-0595

2013-08-26T23:34:35.040-04:00

2018-07-11T21:29:00.290-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21647740 XF inotes-cve20130595-xss(83431) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg21671622 Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3.

cpe:/a:ibm:websphere_application_server:6.1 cpe:/a:ibm:websphere_application_server:6.1.0 cpe:/a:ibm:websphere_application_server:6.1.0.0 cpe:/a:ibm:websphere_application_server:6.1.0.1 cpe:/a:ibm:websphere_application_server:6.1.0.2 cpe:/a:ibm:websphere_application_server:6.1.0.3 cpe:/a:ibm:websphere_application_server:6.1.0.5 cpe:/a:ibm:websphere_application_server:6.1.0.7 cpe:/a:ibm:websphere_application_server:6.1.0.9 cpe:/a:ibm:websphere_application_server:6.1.0.11 cpe:/a:ibm:websphere_application_server:6.1.0.12 cpe:/a:ibm:websphere_application_server:6.1.0.13 cpe:/a:ibm:websphere_application_server:6.1.0.14 cpe:/a:ibm:websphere_application_server:6.1.0.15 cpe:/a:ibm:websphere_application_server:6.1.0.17 cpe:/a:ibm:websphere_application_server:6.1.0.19 cpe:/a:ibm:websphere_application_server:6.1.0.21 cpe:/a:ibm:websphere_application_server:6.1.0.23 cpe:/a:ibm:websphere_application_server:6.1.0.25 cpe:/a:ibm:websphere_application_server:6.1.0.27 cpe:/a:ibm:websphere_application_server:6.1.0.29 cpe:/a:ibm:websphere_application_server:6.1.0.31 cpe:/a:ibm:websphere_application_server:6.1.0.33 cpe:/a:ibm:websphere_application_server:6.1.0.35 cpe:/a:ibm:websphere_application_server:6.1.0.37 cpe:/a:ibm:websphere_application_server:6.1.0.39 cpe:/a:ibm:websphere_application_server:6.1.0.41 cpe:/a:ibm:websphere_application_server:6.1.0.43 cpe:/a:ibm:websphere_application_server:6.1.0.45

CVE-2013-0596

2013-09-20T17:55:05.177-04:00

2017-08-28T21:33:07.777-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21647522 AIXAPAR PM73445 XF was-cve20130596-xss(83608) Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.10 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.12 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.14 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.16 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.18 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.22 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.24 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.0.0.6 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1 cpe:/a:ibm:websphere_application_server:8.5.0.2

CVE-2013-0597

2013-08-21T17:55:05.973-04:00

2017-08-28T21:33:07.840-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR PM85834 AIXAPAR PM87131 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21644047 XF was-cve20130597-xss(83609) Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:rational_clearquest:7.1.1.1 cpe:/a:ibm:rational_clearquest:7.1.1.2 cpe:/a:ibm:rational_clearquest:7.1.1.3 cpe:/a:ibm:rational_clearquest:7.1.1.4 cpe:/a:ibm:rational_clearquest:7.1.1.5 cpe:/a:ibm:rational_clearquest:7.1.1.6 cpe:/a:ibm:rational_clearquest:7.1.1.7 cpe:/a:ibm:rational_clearquest:7.1.1.8 cpe:/a:ibm:rational_clearquest:7.1.2 cpe:/a:ibm:rational_clearquest:7.1.2.1 cpe:/a:ibm:rational_clearquest:7.1.2.2 cpe:/a:ibm:rational_clearquest:7.1.2.3 cpe:/a:ibm:rational_clearquest:7.1.2.4 cpe:/a:ibm:rational_clearquest:7.1.2.5 cpe:/a:ibm:rational_clearquest:7.1.2.6 cpe:/a:ibm:rational_clearquest:7.1.2.7 cpe:/a:ibm:rational_clearquest:7.1.2.8 cpe:/a:ibm:rational_clearquest:7.1.2.9 cpe:/a:ibm:rational_clearquest:7.1.2.10 cpe:/a:ibm:rational_clearquest:7.1.2.11 cpe:/a:ibm:rational_clearquest:8.0 cpe:/a:ibm:rational_clearquest:8.0.0.1 cpe:/a:ibm:rational_clearquest:8.0.0.2 cpe:/a:ibm:rational_clearquest:8.0.0.3 cpe:/a:ibm:rational_clearquest:8.0.0.4 cpe:/a:ibm:rational_clearquest:8.0.0.5 cpe:/a:ibm:rational_clearquest:8.0.0.6 cpe:/a:ibm:rational_clearquest:8.0.0.7 cpe:/a:ibm:rational_clearquest:8.0.1

CVE-2013-0598

2013-09-27T23:40:55.387-04:00

2017-08-28T21:33:07.903-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov AIXAPAR PM88185 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21648665 XF clearquest-cve20130598-csrf(83611) Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the authentication of arbitrary users.

cpe:/a:ibm:rational_directory_server:5.1.1 cpe:/a:ibm:rational_directory_server:5.1.1.1 cpe:/a:ibm:rational_directory_server:5.1.1.2 cpe:/a:ibm:rational_directory_server:5.2 cpe:/a:ibm:rational_directory_server:5.2.0.1 cpe:/a:ibm:rational_directory_server:5.2.0.2 cpe:/a:ibm:rational_directory_server:5.2.1

CVE-2013-0599

2013-05-28T12:55:01.157-04:00

2017-08-28T21:33:07.963-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 60107 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21637151 XF ibm-iehs-cve20130599-info-disclosure(83613) IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information associated with the 500 HTTP status code.

cpe:/h:ibm:websphere_datapower_xc10_appliance:- cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.0.0.0 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.0.0.1 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.0.0.2 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.0.0.3 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.0 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.1 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.2 cpe:/o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.3

CVE-2013-0600

2013-05-09T08:31:18.077-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-05-09T09:19:00.000-04:00

AIXAPAR IC91726 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21636324 Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors.

cpe:/a:adobe:acrobat:9.0 cpe:/a:adobe:acrobat:9.0:-:pro cpe:/a:adobe:acrobat:9.1 cpe:/a:adobe:acrobat:9.1:-:pro cpe:/a:adobe:acrobat:9.1.1 cpe:/a:adobe:acrobat:9.1.1:- cpe:/a:adobe:acrobat:9.1.2 cpe:/a:adobe:acrobat:9.1.3 cpe:/a:adobe:acrobat:9.1.3:- cpe:/a:adobe:acrobat:9.2 cpe:/a:adobe:acrobat:9.2:- cpe:/a:adobe:acrobat:9.3 cpe:/a:adobe:acrobat:9.3:-:pro cpe:/a:adobe:acrobat:9.3.1 cpe:/a:adobe:acrobat:9.3.1:- cpe:/a:adobe:acrobat:9.3.2 cpe:/a:adobe:acrobat:9.3.2:- cpe:/a:adobe:acrobat:9.3.3 cpe:/a:adobe:acrobat:9.3.4 cpe:/a:adobe:acrobat:9.3.4:- cpe:/a:adobe:acrobat:9.4 cpe:/a:adobe:acrobat:9.4.1 cpe:/a:adobe:acrobat:9.4.1:- cpe:/a:adobe:acrobat:9.4.2 cpe:/a:adobe:acrobat:9.4.2:- cpe:/a:adobe:acrobat:9.4.3 cpe:/a:adobe:acrobat:9.4.3:- cpe:/a:adobe:acrobat:9.4.4 cpe:/a:adobe:acrobat:9.4.4:- cpe:/a:adobe:acrobat:9.4.5 cpe:/a:adobe:acrobat:9.4.5:- cpe:/a:adobe:acrobat:9.4.6 cpe:/a:adobe:acrobat:9.4.6:- cpe:/a:adobe:acrobat:9.4.7 cpe:/a:adobe:acrobat:9.5 cpe:/a:adobe:acrobat:9.5.1 cpe:/a:adobe:acrobat:9.5.2 cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0:-:pro cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.1:-:pro cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat_reader:9.0 cpe:/a:adobe:acrobat_reader:9.1 cpe:/a:adobe:acrobat_reader:9.1.1 cpe:/a:adobe:acrobat_reader:9.1.2 cpe:/a:adobe:acrobat_reader:9.1.3 cpe:/a:adobe:acrobat_reader:9.2 cpe:/a:adobe:acrobat_reader:9.3 cpe:/a:adobe:acrobat_reader:9.3.1 cpe:/a:adobe:acrobat_reader:9.3.2 cpe:/a:adobe:acrobat_reader:9.3.3 cpe:/a:adobe:acrobat_reader:9.3.4 cpe:/a:adobe:acrobat_reader:9.4 cpe:/a:adobe:acrobat_reader:9.4.1 cpe:/a:adobe:acrobat_reader:9.4.2 cpe:/a:adobe:acrobat_reader:9.4.3 cpe:/a:adobe:acrobat_reader:9.4.4 cpe:/a:adobe:acrobat_reader:9.4.5 cpe:/a:adobe:acrobat_reader:9.4.6 cpe:/a:adobe:acrobat_reader:9.4.7 cpe:/a:adobe:acrobat_reader:9.5 cpe:/a:adobe:acrobat_reader:9.5.1 cpe:/a:adobe:acrobat_reader:9.5.2 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:11.0

CVE-2013-0601

2013-01-10T06:56:53.503-05:00

2017-09-18T21:35:42.277-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.

CVE-2013-0602

2013-01-10T06:56:53.567-05:00

2017-09-18T21:35:42.370-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2013-0603

2013-01-10T06:56:53.627-05:00

2017-09-18T21:35:42.450-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0604.

CVE-2013-0604

2013-01-10T06:56:53.677-05:00

2017-09-18T21:35:42.543-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0603.

CVE-2013-0605

2013-01-10T06:56:53.737-05:00

2017-09-18T21:35:42.623-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.

CVE-2013-0606

2013-01-10T06:56:53.787-05:00

2017-09-18T21:35:42.717-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.

CVE-2013-0607

2013-01-10T06:56:53.830-05:00

2017-09-18T21:35:42.840-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0608, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.

CVE-2013-0608

2013-01-10T06:56:53.893-05:00

2017-09-18T21:35:42.917-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.

CVE-2013-0609

2013-01-10T06:56:53.940-05:00

2017-09-18T21:35:43.027-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0613.

CVE-2013-0610

2013-01-10T06:56:53.987-05:00

2017-09-18T21:35:43.107-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0626.

CVE-2013-0611

2013-01-10T06:56:54.037-05:00

2017-09-18T21:35:43.183-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0614, and CVE-2013-0618.

CVE-2013-0612

2013-01-10T06:56:54.067-05:00

2017-09-18T21:35:43.277-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.

CVE-2013-0613

2013-01-10T06:56:54.113-05:00

2017-09-18T21:35:43.357-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0609.

CVE-2013-0614

2013-01-10T06:56:54.160-05:00

2017-09-18T21:35:43.433-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0618.

CVE-2013-0615

2013-01-10T06:56:54.190-05:00

2017-09-18T21:35:43.513-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0617, and CVE-2013-0621.

CVE-2013-0616

2013-01-10T06:56:54.223-05:00

2017-09-18T21:35:43.590-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.

CVE-2013-0617

2013-01-10T06:56:54.270-05:00

2017-09-18T21:35:43.683-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, and CVE-2013-0621.

CVE-2013-0618

2013-01-10T06:56:54.317-05:00

2017-09-18T21:35:43.763-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0614.

CVE-2013-0619

2013-01-10T06:56:54.363-05:00

2017-09-18T21:35:43.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0620, and CVE-2013-0623.

CVE-2013-0620

2013-01-10T06:56:54.410-05:00

2017-09-18T21:35:43.933-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, and CVE-2013-0623.

CVE-2013-0621

2013-01-10T06:56:54.440-05:00

2017-09-18T21:35:44.013-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, and CVE-2013-0617.

CVE-2013-0622

2013-01-10T06:56:54.487-05:00

2017-09-18T21:35:44.090-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-0624.

CVE-2013-0623

2013-01-10T06:56:54.550-05:00

2017-09-18T21:35:44.217-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, and CVE-2013-0620.

CVE-2013-0624

2013-01-10T06:56:54.597-05:00

2017-09-18T21:35:44.310-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

cpe:/a:adobe:coldfusion:9.0 cpe:/a:adobe:coldfusion:9.0.1 cpe:/a:adobe:coldfusion:9.0.2 cpe:/a:adobe:coldfusion:10.0

CVE-2013-0625

2013-01-08T20:55:00.803-05:00

2013-01-17T23:50:10.853-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/advisories/apsa13-01.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-03.html BID 57164 Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

CVE-2013-0626

2013-01-10T06:56:54.643-05:00

2017-09-18T21:35:44.387-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 REDHAT RHSA-2013:0150 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0610.

CVE-2013-0627

2013-01-10T06:56:54.690-05:00

2017-09-18T21:35:44.467-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0044 SUSE SUSE-SU-2013:0047 SUSE openSUSE-SU-2013:0138 SUSE openSUSE-SU-2013:0193 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-02.html Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows local users to gain privileges via unknown vectors.

CVE-2013-0628

2017-05-11T10:29:25.123-04:00

2017-05-11T10:29:25.137-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.

cpe:/a:adobe:coldfusion:9.0 cpe:/a:adobe:coldfusion:9.0.1 cpe:/a:adobe:coldfusion:9.0.2 cpe:/a:adobe:coldfusion:10.0

CVE-2013-0629

2013-01-08T20:55:03.553-05:00

2013-01-17T23:50:11.353-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/advisories/apsa13-01.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-03.html BID 57165 Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:flash_player:10.3.181.14 cpe:/a:adobe:flash_player:10.3.181.16 cpe:/a:adobe:flash_player:10.3.181.22 cpe:/a:adobe:flash_player:10.3.181.23 cpe:/a:adobe:flash_player:10.3.181.26 cpe:/a:adobe:flash_player:10.3.181.34 cpe:/a:adobe:flash_player:10.3.183.5 cpe:/a:adobe:flash_player:10.3.183.7 cpe:/a:adobe:flash_player:10.3.183.10 cpe:/a:adobe:flash_player:10.3.183.11 cpe:/a:adobe:flash_player:10.3.183.15 cpe:/a:adobe:flash_player:10.3.183.16 cpe:/a:adobe:flash_player:10.3.183.18 cpe:/a:adobe:flash_player:10.3.183.19 cpe:/a:adobe:flash_player:10.3.183.20 cpe:/a:adobe:flash_player:10.3.183.23 cpe:/a:adobe:flash_player:10.3.183.25 cpe:/a:adobe:flash_player:10.3.183.29 cpe:/a:adobe:flash_player:10.3.183.43 cpe:/a:adobe:flash_player:10.3.183.48 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player_for_android:11.0.1.153 cpe:/a:adobe:flash_player_for_android:11.1.102.59 cpe:/a:adobe:flash_player_for_android:11.1.111.5 cpe:/a:adobe:flash_player_for_android:11.1.111.6 cpe:/a:adobe:flash_player_for_android:11.1.111.7 cpe:/a:adobe:flash_player_for_android:11.1.111.8 cpe:/a:adobe:flash_player_for_android:11.1.111.9 cpe:/a:adobe:flash_player_for_android:11.1.111.10 cpe:/a:adobe:flash_player_for_android:11.1.111.16 cpe:/a:adobe:flash_player_for_android:11.1.111.19 cpe:/a:adobe:flash_player_for_android:11.1.111.24 cpe:/a:adobe:flash_player_for_android:11.1.111.29 cpe:/a:adobe:flash_player_for_android:11.1.115.6 cpe:/a:adobe:flash_player_for_android:11.1.115.7 cpe:/a:adobe:flash_player_for_android:11.1.115.8 cpe:/a:adobe:flash_player_for_android:11.1.115.11 cpe:/a:adobe:flash_player_for_android:11.1.115.12 cpe:/a:adobe:flash_player_for_android:11.1.115.17 cpe:/a:adobe:flash_player_for_android:11.1.115.20 cpe:/a:adobe:flash_player_for_android:11.1.115.27 cpe:/a:adobe:flash_player_for_android:11.1.115.34

CVE-2013-0630

2013-01-11T17:55:01.400-05:00

2013-03-06T00:07:11.163-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0033 SUSE openSUSE-SU-2013:0121 SUSE openSUSE-SU-2013:0128 SUSE openSUSE-SU-2013:0168 SUSE openSUSE-SU-2013:0364 REDHAT RHSA-2013:0149 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-01.html Buffer overflow in Adobe Flash Player before 10.3.183.50 and 11.x before 11.5.502.146 on Windows and Mac OS X, before 10.3.183.50 and 11.x before 11.2.202.261 on Linux, before 11.1.111.31 on Android 2.x and 3.x, and before 11.1.115.36 on Android 4.x; Adobe AIR before 3.5.0.1060; and Adobe AIR SDK before 3.5.0.1060 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:coldfusion:9.0 cpe:/a:adobe:coldfusion:9.0.1 cpe:/a:adobe:coldfusion:9.0.2

CVE-2013-0631

2013-01-08T20:55:03.617-05:00

2013-01-17T23:50:11.650-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/advisories/apsa13-01.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-03.html Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

cpe:/a:adobe:coldfusion:9.0 cpe:/a:adobe:coldfusion:9.0.1 cpe:/a:adobe:coldfusion:9.0.2 cpe:/a:adobe:coldfusion:10.0

CVE-2013-0632

2013-01-16T19:55:01.200-05:00

2014-01-17T00:12:06.673-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/advisories/apsa13-01.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-03.html EXPLOIT-DB 30210 administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

cpe:/a:adobe:flash_player:10.3 cpe:/a:adobe:flash_player:10.3.181.14 cpe:/a:adobe:flash_player:10.3.181.16 cpe:/a:adobe:flash_player:10.3.181.22 cpe:/a:adobe:flash_player:10.3.181.23 cpe:/a:adobe:flash_player:10.3.181.26 cpe:/a:adobe:flash_player:10.3.181.34 cpe:/a:adobe:flash_player:10.3.183.5 cpe:/a:adobe:flash_player:10.3.183.7 cpe:/a:adobe:flash_player:10.3.183.10 cpe:/a:adobe:flash_player:10.3.183.11 cpe:/a:adobe:flash_player:10.3.183.15 cpe:/a:adobe:flash_player:10.3.183.16 cpe:/a:adobe:flash_player:10.3.183.18 cpe:/a:adobe:flash_player:10.3.183.19 cpe:/a:adobe:flash_player:10.3.183.20 cpe:/a:adobe:flash_player:10.3.183.23 cpe:/a:adobe:flash_player:10.3.183.25 cpe:/a:adobe:flash_player:10.3.183.29 cpe:/a:adobe:flash_player:10.3.183.43 cpe:/a:adobe:flash_player:10.3.183.48 cpe:/a:adobe:flash_player:10.3.183.50 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146

CVE-2013-0633

2013-02-08T06:58:21.127-05:00

2018-12-06T14:52:52.220-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:58:11.560-05:00

SUSE openSUSE-SU-2013:0279 SUSE openSUSE-SU-2013:0284 SUSE SUSE-SU-2013:0288 REDHAT RHSA-2013:0243 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-04.html Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

cpe:/a:adobe:flash_player:10.3 cpe:/a:adobe:flash_player:10.3.181.14 cpe:/a:adobe:flash_player:10.3.181.16 cpe:/a:adobe:flash_player:10.3.181.22 cpe:/a:adobe:flash_player:10.3.181.23 cpe:/a:adobe:flash_player:10.3.181.26 cpe:/a:adobe:flash_player:10.3.181.34 cpe:/a:adobe:flash_player:10.3.183.5 cpe:/a:adobe:flash_player:10.3.183.7 cpe:/a:adobe:flash_player:10.3.183.10 cpe:/a:adobe:flash_player:10.3.183.11 cpe:/a:adobe:flash_player:10.3.183.15 cpe:/a:adobe:flash_player:10.3.183.16 cpe:/a:adobe:flash_player:10.3.183.18 cpe:/a:adobe:flash_player:10.3.183.19 cpe:/a:adobe:flash_player:10.3.183.20 cpe:/a:adobe:flash_player:10.3.183.23 cpe:/a:adobe:flash_player:10.3.183.25 cpe:/a:adobe:flash_player:10.3.183.29 cpe:/a:adobe:flash_player:10.3.183.43 cpe:/a:adobe:flash_player:10.3.183.48 cpe:/a:adobe:flash_player:10.3.183.50 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146

CVE-2013-0634

2013-02-08T06:58:21.593-05:00

2018-12-06T14:29:13.010-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:24:44.727-05:00

SUSE openSUSE-SU-2013:0279 SUSE openSUSE-SU-2013:0284 SUSE SUSE-SU-2013:0288 REDHAT RHSA-2013:0243 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-04.html Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in February 2013.

cpe:/a:adobe:shockwave_player:1.0 cpe:/a:adobe:shockwave_player:2.0 cpe:/a:adobe:shockwave_player:3.0 cpe:/a:adobe:shockwave_player:4.0 cpe:/a:adobe:shockwave_player:5.0 cpe:/a:adobe:shockwave_player:6.0 cpe:/a:adobe:shockwave_player:8.0 cpe:/a:adobe:shockwave_player:8.0.196 cpe:/a:adobe:shockwave_player:8.0.196a cpe:/a:adobe:shockwave_player:8.0.204 cpe:/a:adobe:shockwave_player:8.0.205 cpe:/a:adobe:shockwave_player:8.5.1 cpe:/a:adobe:shockwave_player:8.5.1.100 cpe:/a:adobe:shockwave_player:8.5.1.103 cpe:/a:adobe:shockwave_player:8.5.1.105 cpe:/a:adobe:shockwave_player:8.5.1.106 cpe:/a:adobe:shockwave_player:8.5.321 cpe:/a:adobe:shockwave_player:8.5.323 cpe:/a:adobe:shockwave_player:8.5.324 cpe:/a:adobe:shockwave_player:8.5.325 cpe:/a:adobe:shockwave_player:9.0.383 cpe:/a:adobe:shockwave_player:9.0.432 cpe:/a:adobe:shockwave_player:10.0.0.210 cpe:/a:adobe:shockwave_player:10.0.1.004 cpe:/a:adobe:shockwave_player:10.1.0.11 cpe:/a:adobe:shockwave_player:10.1.1.016 cpe:/a:adobe:shockwave_player:10.1.4.020 cpe:/a:adobe:shockwave_player:10.2.0.021 cpe:/a:adobe:shockwave_player:10.2.0.022 cpe:/a:adobe:shockwave_player:10.2.0.023 cpe:/a:adobe:shockwave_player:11.0.0.456 cpe:/a:adobe:shockwave_player:11.0.3.471 cpe:/a:adobe:shockwave_player:11.5.0.595 cpe:/a:adobe:shockwave_player:11.5.0.596 cpe:/a:adobe:shockwave_player:11.5.1.601 cpe:/a:adobe:shockwave_player:11.5.2.602 cpe:/a:adobe:shockwave_player:11.5.6.606 cpe:/a:adobe:shockwave_player:11.5.7.609 cpe:/a:adobe:shockwave_player:11.5.8.612 cpe:/a:adobe:shockwave_player:11.5.9.615 cpe:/a:adobe:shockwave_player:11.5.9.620 cpe:/a:adobe:shockwave_player:11.5.10.620 cpe:/a:adobe:shockwave_player:11.6.0.626 cpe:/a:adobe:shockwave_player:11.6.1.629 cpe:/a:adobe:shockwave_player:11.6.3.633 cpe:/a:adobe:shockwave_player:11.6.4.634 cpe:/a:adobe:shockwave_player:11.6.5.635 cpe:/a:adobe:shockwave_player:11.6.6.636 cpe:/a:adobe:shockwave_player:11.6.7.637 cpe:/a:adobe:shockwave_player:11.6.8.638

CVE-2013-0635

2013-02-13T16:55:06.697-05:00

2013-05-03T23:23:14.890-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-06.html CERT TA13-043A Adobe Shockwave Player before 12.0.0.112 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

CVE-2013-0636

2013-02-13T16:55:06.760-05:00

2013-05-03T23:23:14.957-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-06.html CERT TA13-043A Stack-based buffer overflow in Adobe Shockwave Player before 12.0.0.112 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:air:2.0.0 cpe:/a:adobe:air:2.5 cpe:/a:adobe:air:2.5.1 cpe:/a:adobe:air:2.6 cpe:/a:adobe:air:2.7.0.1948 cpe:/a:adobe:air:2.7.0.1953 cpe:/a:adobe:air:2.7.1.1961 cpe:/a:adobe:air:3.2 cpe:/a:adobe:air:3.3 cpe:/a:adobe:air:3.4 cpe:/a:adobe:air:3.5 cpe:/a:adobe:air_sdk:3.0.0.4080 cpe:/a:adobe:air_sdk:3.4.0.2540 cpe:/a:adobe:air_sdk:3.4.0.2710 cpe:/a:adobe:air_sdk:3.5.0.600 cpe:/a:adobe:air_sdk:3.5.0.890 cpe:/a:adobe:air_sdk:3.5.0.1060 cpe:/a:adobe:flash_player:10.3 cpe:/a:adobe:flash_player:10.3.181.14 cpe:/a:adobe:flash_player:10.3.181.16 cpe:/a:adobe:flash_player:10.3.181.22 cpe:/a:adobe:flash_player:10.3.181.23 cpe:/a:adobe:flash_player:10.3.181.26 cpe:/a:adobe:flash_player:10.3.181.34 cpe:/a:adobe:flash_player:10.3.183.5 cpe:/a:adobe:flash_player:10.3.183.7 cpe:/a:adobe:flash_player:10.3.183.10 cpe:/a:adobe:flash_player:10.3.183.11 cpe:/a:adobe:flash_player:10.3.183.15 cpe:/a:adobe:flash_player:10.3.183.16 cpe:/a:adobe:flash_player:10.3.183.18 cpe:/a:adobe:flash_player:10.3.183.19 cpe:/a:adobe:flash_player:10.3.183.20 cpe:/a:adobe:flash_player:10.3.183.23 cpe:/a:adobe:flash_player:10.3.183.25 cpe:/a:adobe:flash_player:10.3.183.29 cpe:/a:adobe:flash_player:10.3.183.43 cpe:/a:adobe:flash_player:10.3.183.48 cpe:/a:adobe:flash_player:10.3.183.50 cpe:/a:adobe:flash_player:10.3.183.51 cpe:/a:adobe:flash_player:10.3.183.61 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.111.13 cpe:/a:adobe:flash_player:11.1.111.44 cpe:/a:adobe:flash_player:11.1.111.50 cpe:/a:adobe:flash_player:11.1.111.54 cpe:/a:adobe:flash_player:11.1.111.64 cpe:/a:adobe:flash_player:11.1.111.73 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.6.602.167

CVE-2013-0637

2013-02-12T15:55:04.247-05:00

2018-12-06T14:53:30.563-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-12-04T13:59:11.233-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to obtain sensitive information via unspecified vectors.

CVE-2013-0638

2013-02-12T15:55:04.323-05:00

2018-12-06T14:46:05.027-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:39:44.917-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0647.

CVE-2013-0639

2013-02-12T15:55:04.370-05:00

2018-12-06T14:46:34.980-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:41:30.090-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Integer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:adobe:acrobat:9.0 cpe:/a:adobe:acrobat:9.0:-:pro cpe:/a:adobe:acrobat:9.1 cpe:/a:adobe:acrobat:9.1:-:pro cpe:/a:adobe:acrobat:9.1.1 cpe:/a:adobe:acrobat:9.1.1:- cpe:/a:adobe:acrobat:9.1.2 cpe:/a:adobe:acrobat:9.1.3 cpe:/a:adobe:acrobat:9.1.3:- cpe:/a:adobe:acrobat:9.2 cpe:/a:adobe:acrobat:9.2:- cpe:/a:adobe:acrobat:9.3 cpe:/a:adobe:acrobat:9.3:-:pro cpe:/a:adobe:acrobat:9.3.1 cpe:/a:adobe:acrobat:9.3.1:- cpe:/a:adobe:acrobat:9.3.2 cpe:/a:adobe:acrobat:9.3.2:- cpe:/a:adobe:acrobat:9.3.3 cpe:/a:adobe:acrobat:9.3.4 cpe:/a:adobe:acrobat:9.3.4:- cpe:/a:adobe:acrobat:9.4 cpe:/a:adobe:acrobat:9.4.1 cpe:/a:adobe:acrobat:9.4.1:- cpe:/a:adobe:acrobat:9.4.2 cpe:/a:adobe:acrobat:9.4.2:- cpe:/a:adobe:acrobat:9.4.3 cpe:/a:adobe:acrobat:9.4.3:- cpe:/a:adobe:acrobat:9.4.4 cpe:/a:adobe:acrobat:9.4.4:- cpe:/a:adobe:acrobat:9.4.5 cpe:/a:adobe:acrobat:9.4.5:- cpe:/a:adobe:acrobat:9.4.6 cpe:/a:adobe:acrobat:9.4.6:- cpe:/a:adobe:acrobat:9.4.7 cpe:/a:adobe:acrobat:9.5 cpe:/a:adobe:acrobat:9.5.1 cpe:/a:adobe:acrobat:9.5.2 cpe:/a:adobe:acrobat:9.5.3 cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0:-:pro cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.1:-:pro cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat_reader:9.0 cpe:/a:adobe:acrobat_reader:9.1 cpe:/a:adobe:acrobat_reader:9.1.1 cpe:/a:adobe:acrobat_reader:9.1.2 cpe:/a:adobe:acrobat_reader:9.1.3 cpe:/a:adobe:acrobat_reader:9.2 cpe:/a:adobe:acrobat_reader:9.3 cpe:/a:adobe:acrobat_reader:9.3.1 cpe:/a:adobe:acrobat_reader:9.3.2 cpe:/a:adobe:acrobat_reader:9.3.3 cpe:/a:adobe:acrobat_reader:9.3.4 cpe:/a:adobe:acrobat_reader:9.4 cpe:/a:adobe:acrobat_reader:9.4.1 cpe:/a:adobe:acrobat_reader:9.4.2 cpe:/a:adobe:acrobat_reader:9.4.3 cpe:/a:adobe:acrobat_reader:9.4.4 cpe:/a:adobe:acrobat_reader:9.4.5 cpe:/a:adobe:acrobat_reader:9.4.6 cpe:/a:adobe:acrobat_reader:9.4.7 cpe:/a:adobe:acrobat_reader:9.5 cpe:/a:adobe:acrobat_reader:9.5.1 cpe:/a:adobe:acrobat_reader:9.5.2 cpe:/a:adobe:acrobat_reader:9.5.3 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1

CVE-2013-0640

2013-02-13T20:55:02.023-05:00

2017-09-18T21:35:44.543-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html CONFIRM http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html SUSE openSUSE-SU-2013:0335 SUSE openSUSE-SU-2013:0342 SUSE SUSE-SU-2013:0349 REDHAT RHSA-2013:0551 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/advisories/apsa13-02.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-07.html CERT-VN VU#422807 Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

cpe:/a:adobe:acrobat:9.0 cpe:/a:adobe:acrobat:9.0:-:pro cpe:/a:adobe:acrobat:9.1 cpe:/a:adobe:acrobat:9.1:-:pro cpe:/a:adobe:acrobat:9.1.1 cpe:/a:adobe:acrobat:9.1.1:- cpe:/a:adobe:acrobat:9.1.2 cpe:/a:adobe:acrobat:9.1.3 cpe:/a:adobe:acrobat:9.1.3:- cpe:/a:adobe:acrobat:9.2 cpe:/a:adobe:acrobat:9.2:- cpe:/a:adobe:acrobat:9.3 cpe:/a:adobe:acrobat:9.3:-:pro cpe:/a:adobe:acrobat:9.3.1 cpe:/a:adobe:acrobat:9.3.1:- cpe:/a:adobe:acrobat:9.3.2 cpe:/a:adobe:acrobat:9.3.2:- cpe:/a:adobe:acrobat:9.3.3 cpe:/a:adobe:acrobat:9.3.4 cpe:/a:adobe:acrobat:9.3.4:- cpe:/a:adobe:acrobat:9.4 cpe:/a:adobe:acrobat:9.4.1 cpe:/a:adobe:acrobat:9.4.1:- cpe:/a:adobe:acrobat:9.4.2 cpe:/a:adobe:acrobat:9.4.2:- cpe:/a:adobe:acrobat:9.4.3 cpe:/a:adobe:acrobat:9.4.3:- cpe:/a:adobe:acrobat:9.4.4 cpe:/a:adobe:acrobat:9.4.4:- cpe:/a:adobe:acrobat:9.4.5 cpe:/a:adobe:acrobat:9.4.5:- cpe:/a:adobe:acrobat:9.4.6 cpe:/a:adobe:acrobat:9.4.6:- cpe:/a:adobe:acrobat:9.4.7 cpe:/a:adobe:acrobat:9.5 cpe:/a:adobe:acrobat:9.5.1 cpe:/a:adobe:acrobat:9.5.2 cpe:/a:adobe:acrobat:9.5.3 cpe:/a:adobe:acrobat:10.0 cpe:/a:adobe:acrobat:10.0:-:pro cpe:/a:adobe:acrobat:10.0.1 cpe:/a:adobe:acrobat:10.0.1:-:pro cpe:/a:adobe:acrobat:10.0.2 cpe:/a:adobe:acrobat:10.0.3 cpe:/a:adobe:acrobat:10.1 cpe:/a:adobe:acrobat:10.1.1 cpe:/a:adobe:acrobat:10.1.2 cpe:/a:adobe:acrobat:10.1.3 cpe:/a:adobe:acrobat:10.1.4 cpe:/a:adobe:acrobat:10.1.5 cpe:/a:adobe:acrobat:11.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat_reader:9.0 cpe:/a:adobe:acrobat_reader:9.1 cpe:/a:adobe:acrobat_reader:9.1.1 cpe:/a:adobe:acrobat_reader:9.1.2 cpe:/a:adobe:acrobat_reader:9.1.3 cpe:/a:adobe:acrobat_reader:9.2 cpe:/a:adobe:acrobat_reader:9.3 cpe:/a:adobe:acrobat_reader:9.3.1 cpe:/a:adobe:acrobat_reader:9.3.2 cpe:/a:adobe:acrobat_reader:9.3.3 cpe:/a:adobe:acrobat_reader:9.3.4 cpe:/a:adobe:acrobat_reader:9.4 cpe:/a:adobe:acrobat_reader:9.4.1 cpe:/a:adobe:acrobat_reader:9.4.2 cpe:/a:adobe:acrobat_reader:9.4.3 cpe:/a:adobe:acrobat_reader:9.4.4 cpe:/a:adobe:acrobat_reader:9.4.5 cpe:/a:adobe:acrobat_reader:9.4.6 cpe:/a:adobe:acrobat_reader:9.4.7 cpe:/a:adobe:acrobat_reader:9.5 cpe:/a:adobe:acrobat_reader:9.5.1 cpe:/a:adobe:acrobat_reader:9.5.2 cpe:/a:adobe:acrobat_reader:9.5.3 cpe:/a:adobe:acrobat_reader:10.0 cpe:/a:adobe:acrobat_reader:10.0.1 cpe:/a:adobe:acrobat_reader:10.0.2 cpe:/a:adobe:acrobat_reader:10.0.3 cpe:/a:adobe:acrobat_reader:10.1 cpe:/a:adobe:acrobat_reader:10.1.1 cpe:/a:adobe:acrobat_reader:10.1.2 cpe:/a:adobe:acrobat_reader:10.1.3 cpe:/a:adobe:acrobat_reader:10.1.4 cpe:/a:adobe:acrobat_reader:10.1.5 cpe:/a:adobe:acrobat_reader:11.0 cpe:/a:adobe:acrobat_reader:11.0.1

CVE-2013-0641

2013-02-13T20:55:02.070-05:00

2017-09-18T21:35:44.637-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html CONFIRM http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html MISC http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit SUSE openSUSE-SU-2013:0335 SUSE openSUSE-SU-2013:0342 SUSE SUSE-SU-2013:0349 REDHAT RHSA-2013:0551 GENTOO GLSA-201308-03 CONFIRM http://www.adobe.com/support/security/advisories/apsa13-02.html CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-07.html CERT-VN VU#422807 Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

CVE-2013-0642

2013-02-12T15:55:04.403-05:00

2018-12-06T14:47:16.903-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:42:09.030-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

CVE-2013-0643

2013-02-26T19:55:01.017-05:00

2018-12-06T13:46:56.053-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:53:01.463-05:00

SUSE openSUSE-SU-2013:0359 SUSE openSUSE-SU-2013:0360 SUSE SUSE-SU-2013:0373 REDHAT RHSA-2013:0574 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-08.html The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVE-2013-0644

2013-02-12T15:55:04.450-05:00

2018-12-06T14:48:02.123-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:49:45.600-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0649 and CVE-2013-1374.

CVE-2013-0645

2013-02-12T15:55:04.497-05:00

2018-12-06T14:48:36.513-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:50:07.023-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

cpe:/a:adobe:adobe_air cpe:/a:adobe:adobe_air:1.0 cpe:/a:adobe:adobe_air:1.0.1 cpe:/a:adobe:adobe_air:1.0.8.4990 cpe:/a:adobe:adobe_air:1.0.4990 cpe:/a:adobe:adobe_air:1.1 cpe:/a:adobe:adobe_air:1.1.0.5790 cpe:/a:adobe:adobe_air:1.5 cpe:/a:adobe:adobe_air:1.5.0.7220 cpe:/a:adobe:adobe_air:1.5.1 cpe:/a:adobe:adobe_air:1.5.1.8210 cpe:/a:adobe:adobe_air:1.5.2 cpe:/a:adobe:adobe_air:1.5.3 cpe:/a:adobe:adobe_air:1.5.3.9120 cpe:/a:adobe:adobe_air:1.5.3.9130 cpe:/a:adobe:adobe_air:2.0.2 cpe:/a:adobe:adobe_air:2.0.2.12610 cpe:/a:adobe:adobe_air:2.0.3 cpe:/a:adobe:adobe_air:2.0.3.13070 cpe:/a:adobe:adobe_air:2.0.4 cpe:/a:adobe:adobe_air:2.5.0.16600 cpe:/a:adobe:adobe_air:2.5.1.17730 cpe:/a:adobe:adobe_air:2.6 cpe:/a:adobe:adobe_air:2.6.0.19120 cpe:/a:adobe:adobe_air:2.6.0.19140 cpe:/a:adobe:adobe_air:2.7 cpe:/a:adobe:adobe_air:2.7.0.1948 cpe:/a:adobe:adobe_air:2.7.0.1953 cpe:/a:adobe:adobe_air:2.7.0.19480 cpe:/a:adobe:adobe_air:2.7.0.19530 cpe:/a:adobe:adobe_air:2.7.1 cpe:/a:adobe:adobe_air:2.7.1.19610 cpe:/a:adobe:adobe_air:3.0.0.408 cpe:/a:adobe:adobe_air:3.0.0.4080 cpe:/a:adobe:adobe_air:3.1.0.485 cpe:/a:adobe:adobe_air:3.1.0.488 cpe:/a:adobe:adobe_air:3.1.0.4880 cpe:/a:adobe:adobe_air:3.2.0.207 cpe:/a:adobe:adobe_air:3.2.0.2070 cpe:/a:adobe:adobe_air:3.3.0.3670 cpe:/a:adobe:adobe_air:3.4.0.2540 cpe:/a:adobe:adobe_air:3.4.0.2710 cpe:/a:adobe:adobe_air:3.5.0.600 cpe:/a:adobe:adobe_air:3.5.0.880 cpe:/a:adobe:adobe_air:3.5.0.890 cpe:/a:adobe:adobe_air:3.5.0.1060 cpe:/a:adobe:adobe_air:3.6.0.597 cpe:/a:adobe:adobe_air_sdk:3.0.0.4080 cpe:/a:adobe:adobe_air_sdk:3.1.0.488 cpe:/a:adobe:adobe_air_sdk:3.2.0.2070 cpe:/a:adobe:adobe_air_sdk:3.3.0.3650 cpe:/a:adobe:adobe_air_sdk:3.3.0.3690 cpe:/a:adobe:adobe_air_sdk:3.4.0.2540 cpe:/a:adobe:adobe_air_sdk:3.4.0.2710 cpe:/a:adobe:adobe_air_sdk:3.5.0.600 cpe:/a:adobe:adobe_air_sdk:3.5.0.880 cpe:/a:adobe:adobe_air_sdk:3.5.0.890 cpe:/a:adobe:adobe_air_sdk:3.5.0.1060 cpe:/a:adobe:adobe_air_sdk:3.6.0.597 cpe:/a:adobe:adobe_air_sdk_and_compiler:3.6.0.599 cpe:/a:adobe:flash_player:11.0 cpe:/a:adobe:flash_player:11.0.1.152 cpe:/a:adobe:flash_player:11.0.1.152::~~~~x64~ cpe:/a:adobe:flash_player:11.0.1.153 cpe:/a:adobe:flash_player:11.1 cpe:/a:adobe:flash_player:11.1.102.55 cpe:/a:adobe:flash_player:11.1.102.55::~~~~x64~ cpe:/a:adobe:flash_player:11.1.102.59 cpe:/a:adobe:flash_player:11.1.102.62 cpe:/a:adobe:flash_player:11.1.102.63 cpe:/a:adobe:flash_player:11.1.111.5 cpe:/a:adobe:flash_player:11.1.111.6 cpe:/a:adobe:flash_player:11.1.111.7 cpe:/a:adobe:flash_player:11.1.111.8 cpe:/a:adobe:flash_player:11.1.115.7 cpe:/a:adobe:flash_player:11.1.115.34 cpe:/a:adobe:flash_player:11.1.115.36 cpe:/a:adobe:flash_player:11.2.202.223 cpe:/a:adobe:flash_player:11.2.202.228 cpe:/a:adobe:flash_player:11.2.202.233 cpe:/a:adobe:flash_player:11.2.202.235 cpe:/a:adobe:flash_player:11.2.202.236 cpe:/a:adobe:flash_player:11.2.202.238 cpe:/a:adobe:flash_player:11.2.202.243 cpe:/a:adobe:flash_player:11.2.202.251 cpe:/a:adobe:flash_player:11.2.202.258 cpe:/a:adobe:flash_player:11.2.202.261 cpe:/a:adobe:flash_player:11.2.202.262 cpe:/a:adobe:flash_player:11.2.202.270 cpe:/a:adobe:flash_player:11.2.202.273 cpe:/a:adobe:flash_player:11.3.300.257 cpe:/a:adobe:flash_player:11.3.300.262 cpe:/a:adobe:flash_player:11.3.300.265 cpe:/a:adobe:flash_player:11.3.300.268 cpe:/a:adobe:flash_player:11.3.300.270 cpe:/a:adobe:flash_player:11.3.300.271 cpe:/a:adobe:flash_player:11.3.300.273 cpe:/a:adobe:flash_player:11.4.402.265 cpe:/a:adobe:flash_player:11.4.402.278 cpe:/a:adobe:flash_player:11.4.402.287 cpe:/a:adobe:flash_player:11.5.502.110 cpe:/a:adobe:flash_player:11.5.502.135 cpe:/a:adobe:flash_player:11.5.502.136 cpe:/a:adobe:flash_player:11.5.502.146 cpe:/a:adobe:flash_player:11.5.502.149 cpe:/a:adobe:flash_player:11.6.602.167 cpe:/a:adobe:flash_player:11.6.602.168 cpe:/a:adobe:flash_player:11.6.602.171 cpe:/a:adobe:flash_player_for_android:10.1.106.17 cpe:/a:adobe:flash_player_for_android:10.2.157.51 cpe:/a:adobe:flash_player_for_android:10.3.186.7 cpe:/a:adobe:flash_player_for_android:11.0.1.153 cpe:/a:adobe:flash_player_for_android:11.1.102.59 cpe:/a:adobe:flash_player_for_android:11.1.111.5 cpe:/a:adobe:flash_player_for_android:11.1.111.6 cpe:/a:adobe:flash_player_for_android:11.1.111.7 cpe:/a:adobe:flash_player_for_android:11.1.111.8 cpe:/a:adobe:flash_player_for_android:11.1.111.9 cpe:/a:adobe:flash_player_for_android:11.1.111.10 cpe:/a:adobe:flash_player_for_android:11.1.111.16 cpe:/a:adobe:flash_player_for_android:11.1.111.19 cpe:/a:adobe:flash_player_for_android:11.1.111.24 cpe:/a:adobe:flash_player_for_android:11.1.111.29 cpe:/a:adobe:flash_player_for_android:11.1.111.31 cpe:/a:adobe:flash_player_for_android:11.1.111.32 cpe:/a:adobe:flash_player_for_android:11.1.111.43

CVE-2013-0646

2013-03-13T12:55:02.060-04:00

2014-03-26T00:44:11.977-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0458 SUSE openSUSE-SU-2013:0459 SUSE openSUSE-SU-2013:0464 HP HPSBMU02948 REDHAT RHSA-2013:0643 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-09.html Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2013-0647

2013-02-12T15:55:04.557-05:00

2018-12-06T14:50:48.563-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:50:38.350-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0638.

CVE-2013-0648

2013-02-26T19:55:01.160-05:00

2018-12-06T14:51:20.377-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:53:23.260-05:00

SUSE openSUSE-SU-2013:0359 SUSE openSUSE-SU-2013:0360 SUSE SUSE-SU-2013:0373 REDHAT RHSA-2013:0574 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-08.html Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVE-2013-0649

2013-02-12T15:55:04.590-05:00

2018-12-06T14:50:14.467-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-12-04T13:50:34.447-05:00

SUSE openSUSE-SU-2013:0295 SUSE SUSE-SU-2013:0296 SUSE openSUSE-SU-2013:0298 REDHAT RHSA-2013:0254 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-05.html CERT TA13-043A Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0644 and CVE-2013-1374.

CVE-2013-0650

2013-03-13T12:55:02.163-04:00

2014-03-26T00:44:15.773-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0458 SUSE openSUSE-SU-2013:0459 SUSE openSUSE-SU-2013:0464 HP HPSBMU02948 REDHAT RHSA-2013:0643 CONFIRM http://www.adobe.com/support/security/bulletins/apsb13-09.html Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:- cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:2.6 cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:3.0 cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:3.0:sp1 cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:3.5 cpe:/a:ge:intelligent_platforms_proficy_real-time_information_portal:3.5:sp1

CVE-2013-0651

2013-01-27T13:55:03.367-05:00

2013-01-30T00:00:00.000-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-01-28T13:36:00.000-05:00

MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.

CVE-2013-0652

2013-01-27T13:55:03.413-05:00

2013-01-30T00:00:00.000-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-01-28T13:40:00.000-05:00

MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.

cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:4.01 cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:7.5 cpe:/a:ge:intelligent_platforms_proficy_hmi%2fscada_cimplicity:8.0 cpe:/a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:- cpe:/h:ge:intelligent_platforms_proficy_process_systems:-

CVE-2013-0653

2013-01-27T13:55:03.460-05:00

2013-01-29T00:00:00.000-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-01-28T13:41:00.000-05:00

MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.

CVE-2013-0654

2013-01-27T13:55:03.493-05:00

2013-01-29T00:00:00.000-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-01-28T13:43:00.000-05:00

MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.

cpe:/a:schneider-electric:software_update_utility:1.0 cpe:/a:schneider-electric:software_update_utility:1.0.13 cpe:/a:schneider-electric:software_update_utility:1.1

CVE-2013-0655

2013-01-21T11:55:01.793-05:00

2013-01-22T00:00:00.000-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-01-22T09:59:00.000-05:00

CONFIRM http://www.schneider-electric.com/download/ww/en/details/29960967-SE-Software-Update-Utility-Vulnerability-Disclosure/?reference=SEVD-2013-009-01 MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf CONFIRM http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130109_advisory_of_vulnerability_affecting_schneider_electric_s_software_upda.xml The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.

cpe:/a:siemens:simatic_rf-manager:2008 cpe:/a:siemens:simatic_rf-manager_2008:3.0:basic

CVE-2013-0656

2013-01-21T16:55:01.230-05:00

2013-01-22T00:00:00.000-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-01-22T13:01:00.000-05:00

CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-014-01.pdf Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site.

cpe:/a:schneider-electric:interactive_graphical_scada_system:9.0 cpe:/a:schneider-electric:interactive_graphical_scada_system:10.0

CVE-2013-0657

2013-01-21T11:55:01.947-05:00

2018-08-21T06:29:00.270-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://igss.schneider-electric.com/igss/igssupdates/v100/progupdatesv100.zip CONFIRM http://igss.schneider-electric.com/igss/igssupdates/v90/progupdatesv90.zip MISC http://www.us-cert.gov/control_systems/pdf/ICSA-13-018-01.pdf EXPLOIT-DB 45218 Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrary code by sending TCP port-12397 data that does not comply with a protocol.

cpe:/a:schneider-electric:accutech_manager:2.00.1

CVE-2013-0658

2013-02-15T07:09:27.897-05:00

2013-02-19T00:00:00.000-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-02-15T10:32:00.000-05:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-043-01.pdf Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remote attackers to execute arbitrary code via a crafted HTTP request.

cpe:/a:siemens:cp_1604_firmware:2.5.1 cpe:/a:siemens:cp_1616_firmware:2.5.1 cpe:/h:siemens:cp_1604:- cpe:/h:siemens:cp_1616:-

CVE-2013-0659

2013-04-01T12:55:10.147-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-01T14:26:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-084-01.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-628113.pdf The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.

cpe:/a:schneider-electric:concept:2.6:sr7 cpe:/a:schneider-electric:modbus_serial_driver:1.10 cpe:/a:schneider-electric:modbus_serial_driver:2.2 cpe:/a:schneider-electric:modbus_serial_driver:3.2 cpe:/a:schneider-electric:modbuscommdtm_sl:2.1.2 cpe:/a:schneider-electric:opc_factory_server:3.5.0 cpe:/a:schneider-electric:opc_factory_server:3.34 cpe:/a:schneider-electric:opc_factory_server:3.35 cpe:/a:schneider-electric:pl7:4.5:sp7 cpe:/a:schneider-electric:powersuite:2.6 cpe:/a:schneider-electric:sft2841:13.1 cpe:/a:schneider-electric:sft2841:14.0 cpe:/a:schneider-electric:somachine:2.0 cpe:/a:schneider-electric:somachine:3.0::~~xs~~~ cpe:/a:schneider-electric:somachine:3.0:- cpe:/a:schneider-electric:somachine:3.1 cpe:/a:schneider-electric:somove:1.7 cpe:/a:schneider-electric:twidosuite:2.31.04 cpe:/a:schneider-electric:unity_pro:6.0 cpe:/a:schneider-electric:unity_pro:7.0 cpe:/a:schneider-electric:unityloader:2.3

CVE-2013-0662

2014-04-01T02:17:08.240-04:00

2018-08-22T06:29:00.477-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202013-070-01 MISC http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01 BID 66500 EXPLOIT-DB 45219 EXPLOIT-DB 45220 Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.

cpe:/h:schneider-electric:modicon_m340:bmxnoc0401 cpe:/h:schneider-electric:modicon_m340:bmxnoe011xx cpe:/h:schneider-electric:modicon_m340:bmxnoe0100x cpe:/h:schneider-electric:modicon_premium:tsxety4103 cpe:/h:schneider-electric:modicon_premium:tsxety5103 cpe:/h:schneider-electric:modicon_premium:tsxwmy100 cpe:/h:schneider-electric:modicon_quantum_plc:140noe77101 cpe:/h:schneider-electric:modicon_quantum_plc:140noe77111 cpe:/h:schneider-electric:modicon_quantum_plc:140nwm10000

CVE-2013-0663

2013-04-04T07:58:48.687-04:00

2018-05-23T21:29:00.487-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf CONFIRM http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/ CONFIRM http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper EXPLOIT-DB 44678 Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.

cpe:/h:schneider-electric:modicon_m340:bmxnoe0110x cpe:/h:schneider-electric:modicon_premium:tsxety5103 cpe:/h:schneider-electric:modicon_quantum_plc:140noe77111 cpe:/h:schneider-electric:modicon_quantum_plc:140nwm10000

CVE-2013-0664

2013-04-04T07:58:49.823-04:00

2013-04-04T09:43:38.750-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-04-04T09:39:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf CONFIRM http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/ CONFIRM http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests.

cpe:/a:selinc:acselerator_quickset:5.12.0

CVE-2013-0665

2013-03-21T10:55:01.450-04:00

2013-03-21T17:04:43.667-04:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2013-03-21T16:56:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-01.pdf Schweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations.

cpe:/a:matrikonopc:matrikonopc_security_gateway:1.0

CVE-2013-0666

2013-05-01T08:00:08.080-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-05-01T09:12:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01 The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service (unhandled exception and application crash) via a TCP RST packet.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0667

2013-03-21T10:55:01.467-04:00

2013-03-22T09:38:43.657-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-21T17:07:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0668

2013-03-21T10:55:01.480-04:00

2013-03-22T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T08:35:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0669

2013-03-21T10:55:01.497-04:00

2013-03-22T00:00:00.000-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2013-03-22T09:11:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0670

2013-03-21T10:55:01.517-04:00

2013-03-22T00:00:00.000-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T09:17:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0671

2013-03-21T10:55:01.530-04:00

2013-03-22T00:00:00.000-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T09:31:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.

cpe:/a:siemens:wincc_tia_portal:11.0

CVE-2013-0672

2013-03-21T10:55:01.547-04:00

2013-03-22T09:36:18.833-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T09:33:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.

cpe:/a:matrikonopc:matrikonopc_a%26e_historian:1.0.0.0

CVE-2013-0673

2013-05-01T08:00:08.103-04:00

9.4

NETWORK

LOW

NONE

COMPLETE

NONE

COMPLETE

http://nvd.nist.gov

2013-05-01T09:24:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01 Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL.

cpe:/a:siemens:simatic_pcs7:7.1:sp3 cpe:/a:siemens:simatic_pcs7:8.0 cpe:/a:siemens:wincc:5.0 cpe:/a:siemens:wincc:5.0:sp1 cpe:/a:siemens:wincc:6.0 cpe:/a:siemens:wincc:6.0:sp2 cpe:/a:siemens:wincc:6.0:sp3 cpe:/a:siemens:wincc:6.0:sp4 cpe:/a:siemens:wincc:7.0 cpe:/a:siemens:wincc:7.0:sp1 cpe:/a:siemens:wincc:7.0:sp2 cpe:/a:siemens:wincc:7.0:sp3 cpe:/a:siemens:wincc:7.1

CVE-2013-0674

2013-03-21T11:55:01.533-04:00

2013-03-22T09:49:57.633-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-22T09:46:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter.

CVE-2013-0675

2013-03-21T11:55:01.553-04:00

2013-03-22T09:52:30.073-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-03-22T09:51:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Buffer overflow in CCEServer (aka the central communications component) in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet.

CVE-2013-0676

2013-03-21T11:55:01.567-04:00

2013-03-22T09:55:16.407-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T09:54:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query.

CVE-2013-0677

2013-03-21T11:55:01.583-04:00

2013-03-22T10:11:21.193-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2013-03-22T10:06:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf The web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to obtain sensitive information or cause a denial of service via a crafted project file.

cpe:/a:siemens:simatic_pcs7:8.0 cpe:/a:siemens:wincc:7.0 cpe:/a:siemens:wincc:7.0:sp1 cpe:/a:siemens:wincc:7.0:sp2 cpe:/a:siemens:wincc:7.0:sp3

CVE-2013-0678

2013-03-21T11:55:01.600-04:00

2013-03-22T00:00:00.000-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T10:13:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query.

CVE-2013-0679

2013-03-21T11:55:01.613-04:00

2013-03-22T10:25:30.613-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-22T10:24:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Directory traversal vulnerability in the web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote authenticated users to read arbitrary files via vectors involving a query for a pathname.

cpe:/a:cogentdatahub:cascade_datahub:6.4.20 cpe:/a:cogentdatahub:cascade_datahub:6.4.21 cpe:/a:cogentdatahub:cogent_datahub:7.0 cpe:/a:cogentdatahub:cogent_datahub:7.0.2 cpe:/a:cogentdatahub:cogent_datahub:7.1.0 cpe:/a:cogentdatahub:cogent_datahub:7.1.1 cpe:/a:cogentdatahub:cogent_datahub:7.1.1.63 cpe:/a:cogentdatahub:cogent_datahub:7.1.2 cpe:/a:cogentdatahub:cogent_datahub:7.2.2 cpe:/a:cogentdatahub:datahub_quicktrend:7.2.2 cpe:/a:cogentdatahub:opc_datahub:6.4.20 cpe:/a:cogentdatahub:opc_datahub:6.4.21

CVE-2013-0680

2013-04-05T17:55:00.827-04:00

2013-04-09T00:00:00.000-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-04-08T09:53:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP header.

CVE-2013-0681

2013-04-05T17:55:00.847-04:00

2013-04-08T10:09:12.530-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-04-08T10:07:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed data in a formatted text command.

CVE-2013-0682

2013-04-05T17:55:00.863-04:00

2013-04-09T00:00:00.000-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-04-08T10:07:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 do not properly handle exceptions, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command, leading to out-of-bounds access to (1) heap or (2) stack memory.

CVE-2013-0683

2013-04-05T17:55:00.880-04:00

2013-04-08T10:21:35.817-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-04-08T10:20:00.000-04:00

MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service (incorrect pointer access and client crash) via malformed data in a formatted text command.

cpe:/a:invensys:wonderware_information_server:4.0:sp1sp1 cpe:/a:invensys:wonderware_information_server:4.5:-:portal cpe:/a:invensys:wonderware_information_server:5.0:-:portal

CVE-2013-0684

2013-05-09T08:31:18.950-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2013-05-09T09:21:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:invensys:wonderware_information_server:4.0:sp1sp1 cpe:/a:invensys:wonderware_information_server:4.5:-:portal cpe:/a:invensys:wonderware_information_server:5.0:-:portal

CVE-2013-0685

2013-05-09T08:31:18.970-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-05-09T09:27:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.

cpe:/a:invensys:wonderware_information_server:4.0:sp1sp1 cpe:/a:invensys:wonderware_information_server:4.5:-:portal cpe:/a:invensys:wonderware_information_server:5.0:-:portal

CVE-2013-0686

2013-05-09T08:31:18.990-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-05-09T09:34:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:schneider-electric:micom_s1_studio:-

CVE-2013-0687

2013-04-17T22:25:37.237-04:00

2013-04-18T00:00:00.000-04:00

6.6

LOCAL

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-04-18T11:57:00.000-04:00

CONFIRM http://download.schneider-electric.com/files?p_File_Id=56543584&p_File_Name=SEVD-2013-087-01-MiCOM-S1-Studio-SW.pdf MISC http://ics-cert.us-cert.gov/pdf/ICSA-13-100-01.pdf The installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for executable files, which allows local users to modify the service or the configuration files, and consequently gain privileges or trigger incorrect protective-relay operation, via a Trojan horse executable file.

cpe:/a:invensys:wonderware_information_server:4.0:sp1sp1 cpe:/a:invensys:wonderware_information_server:4.5:-:portal cpe:/a:invensys:wonderware_information_server:5.0:-:portal

CVE-2013-0688

2013-05-09T08:31:19.010-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-05-09T09:38:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/h:emerson:dl_8000_remote_terminal_unit:- cpe:/h:emerson:roc_800_remote_terminal_unit:- cpe:/h:emerson:roc_800l_remote_terminal_unit:- cpe:/o:enea:ose:1.20 cpe:/o:enea:ose:2.30 cpe:/o:enea:ose:3.50

CVE-2013-0689

2013-10-03T07:04:37.320-04:00

2013-10-03T13:40:26.257-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-10-03T10:00:50.167-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01 The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors.

CVE-2013-0690

2017-03-15T14:59:00.777-04:00

2017-03-15T14:59:00.793-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0691

2017-03-15T14:59:00.810-04:00

2017-03-15T14:59:00.823-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0692

2013-10-03T07:04:37.383-04:00

2013-10-03T14:07:11.193-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-10-03T06:16:34.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01 The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service.

CVE-2013-0693

2013-10-03T07:04:37.430-04:00

2013-10-03T14:05:49.207-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-10-03T10:16:42.637-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01 The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows remote attackers to obtain potentially sensitive information about device presence by listening for broadcast traffic.

CVE-2013-0694

2013-10-03T07:04:37.447-04:00

2013-10-03T13:13:26.337-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2013-10-03T10:21:10.080-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01 The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the underlying OS by leveraging knowledge of the ROM contents from a product installation elsewhere.

CVE-2013-0695

2017-03-15T14:59:00.840-04:00

2017-03-15T14:59:00.857-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0696

2017-03-15T14:59:00.870-04:00

2017-03-15T14:59:00.887-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0697

2017-03-15T14:59:00.903-04:00

2017-03-15T14:59:00.917-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

CVE-2013-0698

2017-03-15T14:59:00.933-04:00

2017-03-15T14:59:00.950-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.

cpe:/h:galilmc:rio-47100_plc:-

CVE-2013-0699

2013-05-01T08:00:08.340-04:00

2013-05-23T00:00:00.000-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-05-01T09:51:00.000-04:00

MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01 MISC http://www.galilmc.com/support/downloads/firmware_rev/firm47xxx.html The Galil RIO-47100 Pocket PLC allows remote attackers to cause a denial of service via a session that includes "repeated requests."

cpe:/h:siemens:simatic_s7-1200_plc:2.0 cpe:/h:siemens:simatic_s7-1200_plc:2.1 cpe:/h:siemens:simatic_s7-1200_plc:2.2 cpe:/h:siemens:simatic_s7-1200_plc:3.0.0 cpe:/h:siemens:simatic_s7-1200_plc:3.0.1

CVE-2013-0700

2013-04-21T23:27:13.047-04:00

2013-04-22T00:00:00.000-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-22T10:50:00.000-04:00

CONFIRM http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-724606.pdf Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to TCP port 102 (aka the ISO-TSAP port).

cpe:/a:cybozu:garoon:2.5.0 cpe:/a:cybozu:garoon:3.5.3

CVE-2013-0701

2013-02-14T07:11:30.777-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2013-02-14T12:56:00.000-05:00

CONFIRM http://cs.cybozu.co.jp/information/20130125up02.php JVN JVN#07629635 JVNDB JVNDB-2013-000007 SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.

cpe:/a:cybozu:garoon:2.0.0 cpe:/a:cybozu:garoon:2.0.1 cpe:/a:cybozu:garoon:2.0.2 cpe:/a:cybozu:garoon:2.0.3 cpe:/a:cybozu:garoon:2.0.4 cpe:/a:cybozu:garoon:2.0.5 cpe:/a:cybozu:garoon:2.0.6 cpe:/a:cybozu:garoon:2.1.0 cpe:/a:cybozu:garoon:2.1.1 cpe:/a:cybozu:garoon:2.1.2 cpe:/a:cybozu:garoon:2.1.3 cpe:/a:cybozu:garoon:2.5.0 cpe:/a:cybozu:garoon:3.5.3

CVE-2013-0702

2013-02-14T07:11:30.827-05:00

2013-02-14T13:07:03.997-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-14T13:05:00.000-05:00

CONFIRM http://cs.cybozu.co.jp/information/20130125up01.php JVN JVN#95863326 JVNDB JVNDB-2013-000008 Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:big:imgboard:1.22:r6 cpe:/a:big:imgboard:2010

CVE-2013-0703

2013-02-15T07:09:28.460-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-15T10:22:00.000-05:00

JVN JVN#09223079 JVNDB JVNDB-2013-000009 CONFIRM http://www.big.or.jp/~talk/t-club/soft/mini_r6/index.cgi Cross-site scripting (XSS) vulnerability in imgboard.com imgboard before 1.22R6.1 u and 20xx before 2010u allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:gree:gree:1.3.2:-:~~~android~~

CVE-2013-0704

2013-02-15T07:09:28.507-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-15T10:45:00.000-05:00

JVN JVN#78601526 JVNDB JVNDB-2013-000010 Directory traversal vulnerability in the GREE application before 1.3.3 for Android allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications.

cpe:/a:lsi:3ware_disk_manager:-

CVE-2013-0705

2013-02-15T07:09:28.553-05:00

2013-02-19T00:00:00.000-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-15T10:59:00.000-05:00

CONFIRM http://jvn.jp/en/jp/JVN02596643/995349/index.html JVN JVN#02596643 JVNDB JVNDB-2013-000011 Directory traversal vulnerability in LSI 3ware Disk Manager (3DM) before 2 allows remote attackers to read arbitrary files via unspecified vectors.

cpe:/a:nec:universal_raid_utility:1.40 cpe:/a:nec:universal_raid_utility:1.40:rev_680 cpe:/a:nec:universal_raid_utility:2.5 cpe:/a:nec:universal_raid_utility:2.5:rev_2244 cpe:/a:nec:universal_raid_utility:2.31 cpe:/a:nec:universal_raid_utility:2.31:rev_1492

CVE-2013-0706

2013-02-21T19:55:01.333-05:00

2013-03-08T00:00:00.000-05:00

9.0

NETWORK

LOW

NONE

PARTIAL

COMPLETE

http://nvd.nist.gov

2013-02-22T08:22:00.000-05:00

CONFIRM http://jpn.nec.com/security-info/secinfo/nv13-004.html JVN JVN#75585394 JVNDB JVNDB-2013-000012 NEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier does not provide access control, which allows remote attackers to perform arbitrary RAID disk operations via unspecified vectors.

cpe:/a:justsystems:hanako:2006 cpe:/a:justsystems:hanako:2007 cpe:/a:justsystems:hanako:2008 cpe:/a:justsystems:hanako:2009 cpe:/a:justsystems:hanako:2010 cpe:/a:justsystems:hanako:2011 cpe:/a:justsystems:hanako:2012 cpe:/a:justsystems:hanako:2013 cpe:/a:justsystems:hanako_police:- cpe:/a:justsystems:hanako_police:2010 cpe:/a:justsystems:hanako_police3:- cpe:/a:justsystems:ichitaro:2006 cpe:/a:justsystems:ichitaro:2006:-:government cpe:/a:justsystems:ichitaro:2007 cpe:/a:justsystems:ichitaro:2007:-:government cpe:/a:justsystems:ichitaro_portable:-:oreplug

CVE-2013-0707

2013-03-01T00:40:17.647-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-03-01T15:52:00.000-05:00

JVN JVN#16817324 JVNDB JVNDB-2013-000015 CONFIRM http://www.justsystems.com/jp/info/js13001.html Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006 and 2007, Ichitaro Portable with oreplug, Hanako 2006 through 2013, Hanako Police, Hanako Police 3, and Hanako Police 2010 allows remote attackers to execute arbitrary code via a crafted file.

cpe:/a:bayashi:dopvcomet%2a:0009:b

CVE-2013-0708

2013-03-01T00:40:17.690-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-11-30T07:33:30.203-05:00

JVN JVN#64756004 JVNDB JVNDB-2013-000013 CONFIRM http://tech.bayashi.net/dc/ Cross-site scripting (XSS) vulnerability in dopvCOMET* 0009b allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.

cpe:/a:bayashi:dopvstar%2a:0091

CVE-2013-0709

2013-03-01T00:40:17.787-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-01T16:07:00.000-05:00

JVN JVN#36339873 JVNDB JVNDB-2013-000014 CONFIRM http://tech.bayashi.net/ds/ Cross-site scripting (XSS) vulnerability in dopvSTAR* 0091 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.

cpe:/a:kingsoft:writer_2007:- cpe:/a:kingsoft:writer_2010:2723

CVE-2013-0710

2013-03-05T00:05:21.530-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-03-05T13:29:00.000-05:00

CONFIRM http://jvn.jp/en/jp/JVN55924624/22479/index.html JVN JVN#55924624 JVNDB JVNDB-2013-000016 CONFIRM http://www.kingsoft.jp/support/office/support_news/writer2010_2723 Buffer overflow in Kingsoft Writer 2007 and 2010 before 2724 allows remote attackers to execute arbitrary code via a crafted RTF document.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0711

2013-03-20T14:55:01.700-04:00

2013-05-20T23:23:03.920-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01 MISC http://jvn.jp/en/jp/JVN45545972/995359/index.html JVN JVN#45545972 JVNDB JVNDB-2013-000018 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0712

2013-03-20T14:55:01.727-04:00

2013-03-21T00:00:00.000-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2013-03-21T13:26:00.000-04:00

MISC http://jvn.jp/en/jp/JVN01611135/995359/index.html JVN JVN#01611135 JVNDB JVNDB-2013-000019 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0713

2013-03-20T14:55:01.747-04:00

2013-05-20T23:23:04.073-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01 MISC http://jvn.jp/en/jp/JVN52492830/995359/index.html JVN JVN#52492830 JVNDB JVNDB-2013-000020 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0714

2013-03-20T14:55:01.767-04:00

2013-05-20T23:23:04.157-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01 MISC http://jvn.jp/en/jp/JVN20671901/995359/index.html JVN JVN#20671901 JVNDB JVNDB-2013-000021 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0715

2013-03-20T14:55:01.787-04:00

2013-05-20T23:23:04.237-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01 MISC http://jvn.jp/en/jp/JVN65923092/995359/index.html JVN JVN#65923092 JVNDB JVNDB-2013-000022 The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.

cpe:/o:windriver:vxworks:6.5 cpe:/o:windriver:vxworks:6.6 cpe:/o:windriver:vxworks:6.7 cpe:/o:windriver:vxworks:6.8 cpe:/o:windriver:vxworks:6.9

CVE-2013-0716

2013-03-20T14:55:01.807-04:00

2013-05-20T23:23:04.317-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01 MISC http://jvn.jp/en/jp/JVN41022517/995359/index.html JVN JVN#41022517 JVNDB JVNDB-2013-000023 The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.

cpe:/h:nec:atermwm3450rn:- cpe:/h:nec:atermwm3600r:- cpe:/h:nec:atermwr8160n:- cpe:/h:nec:atermwr8370n:- cpe:/h:nec:atermwr8600n:- cpe:/h:nec:atermwr9500n:-

CVE-2013-0717

2013-03-19T14:55:03.347-04:00

2013-03-21T00:00:00.000-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-03-21T10:50:00.000-04:00

CONFIRM http://jpn.nec.com/security-info/secinfo/nv13-005.html CONFIRM http://jvn.jp/en/jp/JVN59503133/6443/index.html JVN JVN#59503133 JVNDB JVNDB-2013-000024 Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.

cpe:/a:simeji:simeji:4.8:-:~~~android~~ cpe:/a:simeji:simeji:4.8.1:-:~~~android~~

CVE-2013-0718

2013-03-27T15:55:01.037-04:00

2013-04-05T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T08:54:00.000-04:00

JVN JVN#77360971 JVNDB JVNDB-2013-000029 The Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.

cpe:/a:codedesign:artime_japanese_input:1.1.2:-:~~~android~~

CVE-2013-0719

2013-03-27T15:55:01.060-04:00

2013-03-28T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T09:24:00.000-04:00

JVN JVN#80922020 JVNDB JVNDB-2013-000026 The ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.

cpe:/a:cob%27s_products:cobime:0.9.2:-:~~~android~~ cpe:/a:cob%27s_products:cobime:0.9.3:-:~~~android~~

CVE-2013-0720

2013-03-27T15:55:01.077-04:00

2013-03-28T00:00:00.000-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-03-28T09:39:00.000-04:00

JVN JVN#11249169 JVNDB JVNDB-2013-000027 The COBIME application before 0.9.4 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.

cpe:/a:wp_php_widget_project:wp_php_widget:1.0.2

CVE-2013-0721

2013-01-02T06:46:23.243-05:00

2017-08-28T21:33:08.043-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov XF wpphpwidget-wpphpwidget-path-disclosure(80906) wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

cpe:/a:ettercap_project:ettercap:0.6.3.1 cpe:/a:ettercap_project:ettercap:0.7.2 cpe:/a:ettercap_project:ettercap:0.7.3 cpe:/a:ettercap_project:ettercap:0.7.4 cpe:/a:ettercap_project:ettercap:0.7.4.1 cpe:/a:ettercap_project:ettercap:0.7.5 cpe:/a:ettercap_project:ettercap:0.7.5.1

CVE-2013-0722

2013-01-11T17:55:01.667-05:00

2016-12-07T22:03:00.987-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov EXPLOIT-DB 23945 MISC http://www.securation.com/files/2013/01/ec.patch BID 57175 CONFIRM https://bugs.gentoo.org/show_bug.cgi?id=451198 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=894092 Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges via a Trojan horse hosts list containing a long line.

cpe:/a:kingsoft:spreadsheets_2012:8.1.0.3030

CVE-2013-0723

2013-07-29T19:27:37.617-04:00

2013-07-30T00:00:00.000-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-07-30T09:45:00.000-04:00

SECTRACK 1028713 Multiple heap-based buffer overflows in etxrw.dll in Kingsoft Spreadsheets 2012 8.1.0.3030 allow remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a crafted spreadsheet file.

cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.0::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.2::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.3::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.4::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.5::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.6::~~~wordpress~~ cpe:/a:wpshopstyling:wp-ecommerce-shop-styling:1.7::~~~wordpress~~

CVE-2013-0724

2014-05-27T10:55:03.383-04:00

2017-08-28T21:33:08.107-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://wordpress.org/plugins/wp-ecommerce-shop-styling/changelog/ BID 57768 XF wp-shopstyling-generatepdf-file-include(81931) PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter.

cpe:/a:hexagon:erdas_er_viewer:11.04

CVE-2013-0726

2013-05-05T07:07:00.433-04:00

2013-05-06T00:00:00.000-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-05-06T09:41:00.000-04:00

Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows remote attackers to execute arbitrary code via a crafted pathname in an ERS file.

cpe:/a:bluemarblegeo:global_mapper:14.1.0

CVE-2013-0727

2013-04-26T07:41:56.867-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-04-26T13:50:00.000-04:00

Multiple untrusted search path vulnerabilities in Global Mapper 14.1.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .gmc, .gmg, .gmp, .gms, .gmw, or .opt file.

cpe:/a:hexagon:erdas_apollo_ecwp:13.00.0000:-:~~~chrome~~ cpe:/a:hexagon:erdas_apollo_ecwp:13.00.0000:-:~~~firefox~~ cpe:/a:hexagon:erdas_apollo_ecwp:13.00.0000:-:~~~internet_explorer~~

CVE-2013-0728

2013-04-24T23:36:12.757-04:00

2013-05-06T00:00:00.000-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2013-04-25T08:50:00.000-04:00

Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote attackers to execute arbitrary code via a long property value.

cpe:/a:tracker-software:pdf-xchange_viewer:1.0.20 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.22 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.23 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.24 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.25 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.26 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.27 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.28 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.29 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.30 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.31 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.32 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.33 cpe:/a:tracker-software:pdf-xchange_viewer:1.0.34 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.35 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.36 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.37 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.37.1 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.37.2 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.38.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.38.1 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.38.2 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.39.2 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.40.4 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.40.5 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.40.7 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.41.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.41.1 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.41.2 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.41.3 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.41.4 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.1 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.2 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.3 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.4 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.5 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.6 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.7 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.8 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.9 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.42.10 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.43.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.44.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.45.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.46.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.47.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.48.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.49.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.50.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.51.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.52.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.53.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.54.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.55.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.56.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.0.57.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.188.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.189.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.190.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.191.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.192.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.193.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.194.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.195.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.196.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.197.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.198.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.199.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.200.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.201.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.202.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.203.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.204.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.205.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.206.0 cpe:/a:tracker-software:pdf-xchange_viewer:2.5.207.0

CVE-2013-0729

2014-04-02T12:17:06.477-04:00

2018-10-30T12:28:08.013-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2018-10-23T12:35:25.047-04:00

BID 57491 CONFIRM http://www.tracker-software.com/company/news_press_events/view/123 XF pdfxchange-viewer-bo(81427) Heap-based buffer overflow in Tracker Software PDF-XChange before 2.5.208 allows remote attackers to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream in a PDF file.

cpe:/a:sourcefabric:newscoop:4.0:rc3 cpe:/a:sourcefabric:newscoop:4.0.1 cpe:/a:sourcefabric:newscoop:4.0.2 cpe:/a:sourcefabric:newscoop:4.0.3 cpe:/a:sourcefabric:newscoop:4.0.4 cpe:/a:sourcefabric:newscoop:4.1.0

CVE-2013-0730

2013-02-21T19:55:01.397-05:00

2013-02-25T00:00:00.000-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-02-22T08:09:00.000-05:00

CONFIRM http://forum.sourcefabric.org/discussion/15052/security-patch-released-for-newscoop-4-1 CONFIRM https://github.com/sourcefabric/Newscoop/commit/4f948ba3afaaeb616006cbabc85906ef3254169d Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.

cpe:/a:mailup:wp-mailup:1.0.0 cpe:/a:mailup:wp-mailup:1.1.0 cpe:/a:mailup:wp-mailup:1.1.1 cpe:/a:mailup:wp-mailup:1.1.2 cpe:/a:mailup:wp-mailup:1.1.3 cpe:/a:mailup:wp-mailup:1.2 cpe:/a:mailup:wp-mailup:1.3 cpe:/a:mailup:wp-mailup:1.3.1 cpe:/a:mailup:wp-mailup:1.3.2 cpe:/a:mailup:wp-mailup:1.21

CVE-2013-0731

2013-03-22T11:55:01.063-04:00

2017-08-28T21:33:08.247-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://plugins.trac.wordpress.org/changeset?new=682420 CONFIRM http://wordpress.org/extend/plugins/wp-mailup/changelog/ BID 58467 XF mailup-ajaxfunctions-security-bypass(82847) ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.

cpe:/a:nuance:pdf_reader:6.0 cpe:/a:nuance:pdf_reader:7.0

CVE-2013-0732

2014-03-27T12:55:05.457-04:00

2014-03-27T14:09:37.233-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2014-03-27T14:09:34.107-04:00

BID 60315 Heap-based buffer overflow in PDFCore8.dll in Nuance PDF Reader before 8.1 allows remote attackers to execute arbitrary code via crafted font table directory values in a TTF file, related to naming table entries.

cpe:/a:corel:paintshop_pro_x5:15.2.0.2 cpe:/a:corel:paintshop_pro_x6:16.0.0.113

CVE-2013-0733

2014-06-05T16:55:04.267-04:00

2019-07-18T08:26:38.797-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-07-17T08:19:57.213-04:00

BID 62836 XF corel-paintshop-cve20130733-code-exec(87763) Untrusted search path vulnerability in Corel PaintShop Pro X5 and X6 16.0.0.113, 15.2.0.2, and earlier allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jpg file.

cpe:/a:cartpauj:mingle-forum:1.0.00 cpe:/a:cartpauj:mingle-forum:1.0.01 cpe:/a:cartpauj:mingle-forum:1.0.02 cpe:/a:cartpauj:mingle-forum:1.0.03 cpe:/a:cartpauj:mingle-forum:1.0.04 cpe:/a:cartpauj:mingle-forum:1.0.05 cpe:/a:cartpauj:mingle-forum:1.0.06 cpe:/a:cartpauj:mingle-forum:1.0.07 cpe:/a:cartpauj:mingle-forum:1.0.08 cpe:/a:cartpauj:mingle-forum:1.0.09 cpe:/a:cartpauj:mingle-forum:1.0.10 cpe:/a:cartpauj:mingle-forum:1.0.11 cpe:/a:cartpauj:mingle-forum:1.0.12 cpe:/a:cartpauj:mingle-forum:1.0.13 cpe:/a:cartpauj:mingle-forum:1.0.14 cpe:/a:cartpauj:mingle-forum:1.0.15 cpe:/a:cartpauj:mingle-forum:1.0.16 cpe:/a:cartpauj:mingle-forum:1.0.17 cpe:/a:cartpauj:mingle-forum:1.0.18 cpe:/a:cartpauj:mingle-forum:1.0.19 cpe:/a:cartpauj:mingle-forum:1.0.20 cpe:/a:cartpauj:mingle-forum:1.0.21 cpe:/a:cartpauj:mingle-forum:1.0.21.1 cpe:/a:cartpauj:mingle-forum:1.0.22 cpe:/a:cartpauj:mingle-forum:1.0.23 cpe:/a:cartpauj:mingle-forum:1.0.23.1 cpe:/a:cartpauj:mingle-forum:1.0.23.2 cpe:/a:cartpauj:mingle-forum:1.0.24 cpe:/a:cartpauj:mingle-forum:1.0.25 cpe:/a:cartpauj:mingle-forum:1.0.26 cpe:/a:cartpauj:mingle-forum:1.0.27 cpe:/a:cartpauj:mingle-forum:1.0.28 cpe:/a:cartpauj:mingle-forum:1.0.28.1 cpe:/a:cartpauj:mingle-forum:1.0.28.2 cpe:/a:cartpauj:mingle-forum:1.0.29 cpe:/a:cartpauj:mingle-forum:1.0.30 cpe:/a:cartpauj:mingle-forum:1.0.31 cpe:/a:cartpauj:mingle-forum:1.0.31.1 cpe:/a:cartpauj:mingle-forum:1.0.31.2 cpe:/a:cartpauj:mingle-forum:1.0.31.3 cpe:/a:cartpauj:mingle-forum:1.0.31.4 cpe:/a:cartpauj:mingle-forum:1.0.32 cpe:/a:cartpauj:mingle-forum:1.0.32.1 cpe:/a:cartpauj:mingle-forum:1.0.33

CVE-2013-0734

2014-03-28T11:55:08.327-04:00

2017-08-28T21:33:08.357-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 58059 XF wp-mingleforum-index-admin-xss(82187) Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.

CVE-2013-0735

2014-04-02T14:55:21.657-04:00

2017-08-28T21:33:08.417-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 58059 XF wp-mingleforum-index-sql-injection(82188) Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic (1) remove_post, (2) sticky, or (3) closed action or (4) thread parameter in a postreply action to index.php.

CVE-2013-0736

2013-10-09T18:55:02.617-04:00

2013-10-10T16:23:21.040-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2013-10-10T09:26:45.743-04:00

BID 62133 Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) modify user privileges or (2) conduct cross-site scripting (XSS) attacks via unspecified vectors.

cpe:/a:dell:openmanage_server_administrator:7.0.0 cpe:/a:dell:openmanage_server_administrator:7.0.0.1 cpe:/a:dell:openmanage_server_administrator:7.1.0 cpe:/a:dell:openmanage_server_administrator:7.1.0.1 cpe:/a:dell:openmanage_server_administrator:7.2.0

CVE-2013-0740

2014-04-10T16:29:23.487-04:00

2014-04-11T12:14:59.140-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2014-04-11T12:14:57.093-04:00

BID 61383 Open redirect vulnerability in Dell OpenManage Server Administrator (OMSA) before 7.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter to HelpViewer.

cpe:/a:percipientstudios:imagen:2.5.1:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.2:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.3:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.4:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.5:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.6:-:~~~umbraco_cms~~ cpe:/a:percipientstudios:imagen:2.5.7:-:~~~umbraco_cms~~

CVE-2013-0741

2013-11-18T23:45:06.543-05:00

2013-11-19T14:06:11.520-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2013-11-19T10:22:09.397-05:00

CONFIRM http://our.umbraco.org/projects/website-utilities/imagegen Cross-site scripting (XSS) vulnerability in imagegen.ashx in Percipient Studios ImageGen before 2.9.0 for Umbraco CMS allows remote attackers to inject arbitrary web script or HTML via the font parameter.

cpe:/a:corel:pdf_fusion:1.11

CVE-2013-0742

2013-10-03T19:55:04.067-04:00

2013-10-07T09:35:52.220-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2013-10-04T11:26:25.837-04:00

EXPLOIT-DB 26805 Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long ZIP directory entry name in an XPS file.

CVE-2013-0743

2013-01-25T13:55:01.210-05:00

2016-12-15T21:59:02.833-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA at the suggestion of the CVE project team. The candidate had been associated with a correct report of a security problem, but not a problem that is categorized as a vulnerability within CVE. Compromised or unauthorized SSL certificates are not within CVE's scope. Notes: none.

cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox_esr:10.0 cpe:/a:mozilla:firefox_esr:10.0.1 cpe:/a:mozilla:firefox_esr:10.0.2 cpe:/a:mozilla:firefox_esr:10.0.3 cpe:/a:mozilla:firefox_esr:10.0.4 cpe:/a:mozilla:firefox_esr:10.0.5 cpe:/a:mozilla:firefox_esr:10.0.6 cpe:/a:mozilla:firefox_esr:10.0.7 cpe:/a:mozilla:firefox_esr:10.0.8 cpe:/a:mozilla:firefox_esr:10.0.9 cpe:/a:mozilla:firefox_esr:10.0.10 cpe:/a:mozilla:firefox_esr:10.0.11 cpe:/a:mozilla:firefox_esr:17.0 cpe:/a:mozilla:firefox_esr:17.0.1 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0::beta cpe:/a:mozilla:seamonkey:1.0::dev cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.99 cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.5:1.1.10 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.11 cpe:/a:mozilla:seamonkey:2.0.12 cpe:/a:mozilla:seamonkey:2.0.13 cpe:/a:mozilla:seamonkey:2.0.14 cpe:/a:mozilla:seamonkey:2.0a1::pre cpe:/a:mozilla:seamonkey:2.0a1pre cpe:/a:mozilla:seamonkey:2.1 cpe:/a:mozilla:seamonkey:2.1:alpha1 cpe:/a:mozilla:seamonkey:2.1:alpha2 cpe:/a:mozilla:seamonkey:2.1:alpha3 cpe:/a:mozilla:seamonkey:2.1:beta1 cpe:/a:mozilla:seamonkey:2.1:beta2 cpe:/a:mozilla:seamonkey:2.1:beta3 cpe:/a:mozilla:seamonkey:2.1:rc1 cpe:/a:mozilla:seamonkey:2.1:rc2 cpe:/a:mozilla:seamonkey:2.2 cpe:/a:mozilla:seamonkey:2.2:beta1 cpe:/a:mozilla:seamonkey:2.2:beta2 cpe:/a:mozilla:seamonkey:2.2:beta3 cpe:/a:mozilla:seamonkey:2.3 cpe:/a:mozilla:seamonkey:2.3:beta1 cpe:/a:mozilla:seamonkey:2.3:beta2 cpe:/a:mozilla:seamonkey:2.3:beta3 cpe:/a:mozilla:seamonkey:2.3.1 cpe:/a:mozilla:seamonkey:2.3.2 cpe:/a:mozilla:seamonkey:2.3.3 cpe:/a:mozilla:seamonkey:2.4 cpe:/a:mozilla:seamonkey:2.4:beta1 cpe:/a:mozilla:seamonkey:2.4:beta2 cpe:/a:mozilla:seamonkey:2.4:beta3 cpe:/a:mozilla:seamonkey:2.4.1 cpe:/a:mozilla:seamonkey:2.5 cpe:/a:mozilla:seamonkey:2.5:beta1 cpe:/a:mozilla:seamonkey:2.5:beta2 cpe:/a:mozilla:seamonkey:2.5:beta3 cpe:/a:mozilla:seamonkey:2.5:beta4 cpe:/a:mozilla:seamonkey:2.6 cpe:/a:mozilla:seamonkey:2.6:beta1 cpe:/a:mozilla:seamonkey:2.6:beta2 cpe:/a:mozilla:seamonkey:2.6:beta3 cpe:/a:mozilla:seamonkey:2.6:beta4 cpe:/a:mozilla:seamonkey:2.6.1 cpe:/a:mozilla:seamonkey:2.7 cpe:/a:mozilla:seamonkey:2.7:beta1 cpe:/a:mozilla:seamonkey:2.7:beta2 cpe:/a:mozilla:seamonkey:2.7:beta3 cpe:/a:mozilla:seamonkey:2.7:beta4 cpe:/a:mozilla:seamonkey:2.7:beta5 cpe:/a:mozilla:seamonkey:2.7.1 cpe:/a:mozilla:seamonkey:2.7.2 cpe:/a:mozilla:seamonkey:2.8 cpe:/a:mozilla:seamonkey:2.8:beta1 cpe:/a:mozilla:seamonkey:2.8:beta2 cpe:/a:mozilla:seamonkey:2.8:beta3 cpe:/a:mozilla:seamonkey:2.8:beta4 cpe:/a:mozilla:seamonkey:2.8:beta5 cpe:/a:mozilla:seamonkey:2.8:beta6 cpe:/a:mozilla:seamonkey:2.9 cpe:/a:mozilla:seamonkey:2.9:beta1 cpe:/a:mozilla:seamonkey:2.9:beta2 cpe:/a:mozilla:seamonkey:2.9:beta3 cpe:/a:mozilla:seamonkey:2.9:beta4 cpe:/a:mozilla:seamonkey:2.9.1 cpe:/a:mozilla:seamonkey:2.10 cpe:/a:mozilla:seamonkey:2.10:beta1 cpe:/a:mozilla:seamonkey:2.10:beta2 cpe:/a:mozilla:seamonkey:2.10:beta3 cpe:/a:mozilla:seamonkey:2.10.1 cpe:/a:mozilla:seamonkey:2.11 cpe:/a:mozilla:seamonkey:2.11:beta1 cpe:/a:mozilla:seamonkey:2.11:beta2 cpe:/a:mozilla:seamonkey:2.11:beta3 cpe:/a:mozilla:seamonkey:2.11:beta4 cpe:/a:mozilla:seamonkey:2.11:beta5 cpe:/a:mozilla:seamonkey:2.11:beta6 cpe:/a:mozilla:seamonkey:2.12 cpe:/a:mozilla:seamonkey:2.12:beta1 cpe:/a:mozilla:seamonkey:2.12:beta2 cpe:/a:mozilla:seamonkey:2.12:beta3 cpe:/a:mozilla:seamonkey:2.12:beta4 cpe:/a:mozilla:seamonkey:2.12:beta5 cpe:/a:mozilla:seamonkey:2.12:beta6 cpe:/a:mozilla:seamonkey:2.12.1 cpe:/a:mozilla:seamonkey:2.13 cpe:/a:mozilla:seamonkey:2.13:beta1 cpe:/a:mozilla:seamonkey:2.13:beta2 cpe:/a:mozilla:seamonkey:2.13:beta3 cpe:/a:mozilla:seamonkey:2.13:beta4 cpe:/a:mozilla:seamonkey:2.13:beta5 cpe:/a:mozilla:seamonkey:2.13:beta6 cpe:/a:mozilla:seamonkey:2.13.1 cpe:/a:mozilla:seamonkey:2.13.2 cpe:/a:mozilla:seamonkey:2.14 cpe:/a:mozilla:seamonkey:2.14:beta1 cpe:/a:mozilla:seamonkey:2.14:beta2 cpe:/a:mozilla:seamonkey:2.14:beta3 cpe:/a:mozilla:seamonkey:2.14:beta4 cpe:/a:mozilla:seamonkey:2.14:beta5 cpe:/a:mozilla:seamonkey:2.14.1 cpe:/a:mozilla:seamonkey:2.15:beta1 cpe:/a:mozilla:seamonkey:2.15:beta2 cpe:/a:mozilla:seamonkey:2.15:beta3 cpe:/a:mozilla:seamonkey:2.15:beta4 cpe:/a:mozilla:seamonkey:2.15:beta5 cpe:/a:mozilla:seamonkey:2.15:beta6 cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.0.8 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 cpe:/a:mozilla:thunderbird:1.5.0.2 cpe:/a:mozilla:thunderbird:1.5.0.3 cpe:/a:mozilla:thunderbird:1.5.0.4 cpe:/a:mozilla:thunderbird:1.5.0.5 cpe:/a:mozilla:thunderbird:1.5.0.6 cpe:/a:mozilla:thunderbird:1.5.0.7 cpe:/a:mozilla:thunderbird:1.5.0.8 cpe:/a:mozilla:thunderbird:1.5.0.9 cpe:/a:mozilla:thunderbird:1.5.0.10 cpe:/a:mozilla:thunderbird:1.5.0.11 cpe:/a:mozilla:thunderbird:1.5.0.12 cpe:/a:mozilla:thunderbird:1.5.0.13 cpe:/a:mozilla:thunderbird:1.5.0.14 cpe:/a:mozilla:thunderbird:1.5.1 cpe:/a:mozilla:thunderbird:1.5.2 cpe:/a:mozilla:thunderbird:1.7.1 cpe:/a:mozilla:thunderbird:1.7.3 cpe:/a:mozilla:thunderbird:2.0 cpe:/a:mozilla:thunderbird:2.0.0.0 cpe:/a:mozilla:thunderbird:2.0.0.1 cpe:/a:mozilla:thunderbird:2.0.0.2 cpe:/a:mozilla:thunderbird:2.0.0.3 cpe:/a:mozilla:thunderbird:2.0.0.4 cpe:/a:mozilla:thunderbird:2.0.0.5 cpe:/a:mozilla:thunderbird:2.0.0.6 cpe:/a:mozilla:thunderbird:2.0.0.7 cpe:/a:mozilla:thunderbird:2.0.0.8 cpe:/a:mozilla:thunderbird:2.0.0.9 cpe:/a:mozilla:thunderbird:2.0.0.11 cpe:/a:mozilla:thunderbird:2.0.0.12 cpe:/a:mozilla:thunderbird:2.0.0.13 cpe:/a:mozilla:thunderbird:2.0.0.14 cpe:/a:mozilla:thunderbird:2.0.0.15 cpe:/a:mozilla:thunderbird:2.0.0.16 cpe:/a:mozilla:thunderbird:2.0.0.17 cpe:/a:mozilla:thunderbird:2.0.0.18 cpe:/a:mozilla:thunderbird:2.0.0.19 cpe:/a:mozilla:thunderbird:2.0.0.20 cpe:/a:mozilla:thunderbird:2.0.0.21 cpe:/a:mozilla:thunderbird:2.0.0.22 cpe:/a:mozilla:thunderbird:2.0.0.23 cpe:/a:mozilla:thunderbird:3.0 cpe:/a:mozilla:thunderbird:3.0.1 cpe:/a:mozilla:thunderbird:3.0.2 cpe:/a:mozilla:thunderbird:3.0.3 cpe:/a:mozilla:thunderbird:3.0.4 cpe:/a:mozilla:thunderbird:3.0.5 cpe:/a:mozilla:thunderbird:3.0.6 cpe:/a:mozilla:thunderbird:3.0.7 cpe:/a:mozilla:thunderbird:3.0.8 cpe:/a:mozilla:thunderbird:3.0.9 cpe:/a:mozilla:thunderbird:3.0.10 cpe:/a:mozilla:thunderbird:3.0.11 cpe:/a:mozilla:thunderbird:3.1 cpe:/a:mozilla:thunderbird:3.1.1 cpe:/a:mozilla:thunderbird:3.1.2 cpe:/a:mozilla:thunderbird:3.1.3 cpe:/a:mozilla:thunderbird:3.1.4 cpe:/a:mozilla:thunderbird:3.1.5 cpe:/a:mozilla:thunderbird:3.1.6 cpe:/a:mozilla:thunderbird:3.1.7 cpe:/a:mozilla:thunderbird:3.1.8 cpe:/a:mozilla:thunderbird:3.1.9 cpe:/a:mozilla:thunderbird:3.1.10 cpe:/a:mozilla:thunderbird:3.1.11 cpe:/a:mozilla:thunderbird:3.1.12 cpe:/a:mozilla:thunderbird:3.1.13 cpe:/a:mozilla:thunderbird:3.1.14 cpe:/a:mozilla:thunderbird:3.1.15 cpe:/a:mozilla:thunderbird:3.1.16 cpe:/a:mozilla:thunderbird:3.1.17 cpe:/a:mozilla:thunderbird:5.0 cpe:/a:mozilla:thunderbird:6.0 cpe:/a:mozilla:thunderbird:6.0.1 cpe:/a:mozilla:thunderbird:6.0.2 cpe:/a:mozilla:thunderbird:7.0 cpe:/a:mozilla:thunderbird:7.0.1 cpe:/a:mozilla:thunderbird:8.0 cpe:/a:mozilla:thunderbird:9.0 cpe:/a:mozilla:thunderbird:9.0.1 cpe:/a:mozilla:thunderbird:10.0 cpe:/a:mozilla:thunderbird:10.0.1 cpe:/a:mozilla:thunderbird:10.0.2 cpe:/a:mozilla:thunderbird:10.0.3 cpe:/a:mozilla:thunderbird:10.0.4 cpe:/a:mozilla:thunderbird:11.0 cpe:/a:mozilla:thunderbird:11.0.1 cpe:/a:mozilla:thunderbird:12.0 cpe:/a:mozilla:thunderbird:12.0.1 cpe:/a:mozilla:thunderbird:13.0 cpe:/a:mozilla:thunderbird:13.0.1 cpe:/a:mozilla:thunderbird:14.0 cpe:/a:mozilla:thunderbird:15.0 cpe:/a:mozilla:thunderbird:15.0.1 cpe:/a:mozilla:thunderbird:16.0 cpe:/a:mozilla:thunderbird:16.0.1 cpe:/a:mozilla:thunderbird:16.0.2 cpe:/a:mozilla:thunderbird:17.0 cpe:/a:mozilla:thunderbird_esr:10.0 cpe:/a:mozilla:thunderbird_esr:10.0.1 cpe:/a:mozilla:thunderbird_esr:10.0.2 cpe:/a:mozilla:thunderbird_esr:10.0.3 cpe:/a:mozilla:thunderbird_esr:10.0.4 cpe:/a:mozilla:thunderbird_esr:10.0.5 cpe:/a:mozilla:thunderbird_esr:10.0.6 cpe:/a:mozilla:thunderbird_esr:10.0.7 cpe:/a:mozilla:thunderbird_esr:10.0.8 cpe:/a:mozilla:thunderbird_esr:10.0.9 cpe:/a:mozilla:thunderbird_esr:10.0.10 cpe:/a:mozilla:thunderbird_esr:10.0.11 cpe:/a:mozilla:thunderbird_esr:17.0 cpe:/a:mozilla:thunderbird_esr:17.0.1

CVE-2013-0744

2013-01-13T15:55:01.430-05:00

2017-09-18T21:35:44.763-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 REDHAT RHSA-2013:0144 REDHAT RHSA-2013:0145 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-05.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=814713 Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an HTML document with a table containing many columns and column groups.

cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox_esr:17.0 cpe:/a:mozilla:firefox_esr:17.0.1 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0::beta cpe:/a:mozilla:seamonkey:1.0::dev cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.99 cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.5:1.1.10 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.11 cpe:/a:mozilla:seamonkey:2.0.12 cpe:/a:mozilla:seamonkey:2.0.13 cpe:/a:mozilla:seamonkey:2.0.14 cpe:/a:mozilla:seamonkey:2.0a1::pre cpe:/a:mozilla:seamonkey:2.0a1pre cpe:/a:mozilla:seamonkey:2.1 cpe:/a:mozilla:seamonkey:2.1:alpha1 cpe:/a:mozilla:seamonkey:2.1:alpha2 cpe:/a:mozilla:seamonkey:2.1:alpha3 cpe:/a:mozilla:seamonkey:2.1:beta1 cpe:/a:mozilla:seamonkey:2.1:beta2 cpe:/a:mozilla:seamonkey:2.1:beta3 cpe:/a:mozilla:seamonkey:2.1:rc1 cpe:/a:mozilla:seamonkey:2.1:rc2 cpe:/a:mozilla:seamonkey:2.2 cpe:/a:mozilla:seamonkey:2.2:beta1 cpe:/a:mozilla:seamonkey:2.2:beta2 cpe:/a:mozilla:seamonkey:2.2:beta3 cpe:/a:mozilla:seamonkey:2.3 cpe:/a:mozilla:seamonkey:2.3:beta1 cpe:/a:mozilla:seamonkey:2.3:beta2 cpe:/a:mozilla:seamonkey:2.3:beta3 cpe:/a:mozilla:seamonkey:2.3.1 cpe:/a:mozilla:seamonkey:2.3.2 cpe:/a:mozilla:seamonkey:2.3.3 cpe:/a:mozilla:seamonkey:2.4 cpe:/a:mozilla:seamonkey:2.4:beta1 cpe:/a:mozilla:seamonkey:2.4:beta2 cpe:/a:mozilla:seamonkey:2.4:beta3 cpe:/a:mozilla:seamonkey:2.4.1 cpe:/a:mozilla:seamonkey:2.5 cpe:/a:mozilla:seamonkey:2.5:beta1 cpe:/a:mozilla:seamonkey:2.5:beta2 cpe:/a:mozilla:seamonkey:2.5:beta3 cpe:/a:mozilla:seamonkey:2.5:beta4 cpe:/a:mozilla:seamonkey:2.6 cpe:/a:mozilla:seamonkey:2.6:beta1 cpe:/a:mozilla:seamonkey:2.6:beta2 cpe:/a:mozilla:seamonkey:2.6:beta3 cpe:/a:mozilla:seamonkey:2.6:beta4 cpe:/a:mozilla:seamonkey:2.6.1 cpe:/a:mozilla:seamonkey:2.7 cpe:/a:mozilla:seamonkey:2.7:beta1 cpe:/a:mozilla:seamonkey:2.7:beta2 cpe:/a:mozilla:seamonkey:2.7:beta3 cpe:/a:mozilla:seamonkey:2.7:beta4 cpe:/a:mozilla:seamonkey:2.7:beta5 cpe:/a:mozilla:seamonkey:2.7.1 cpe:/a:mozilla:seamonkey:2.7.2 cpe:/a:mozilla:seamonkey:2.8 cpe:/a:mozilla:seamonkey:2.8:beta1 cpe:/a:mozilla:seamonkey:2.8:beta2 cpe:/a:mozilla:seamonkey:2.8:beta3 cpe:/a:mozilla:seamonkey:2.8:beta4 cpe:/a:mozilla:seamonkey:2.8:beta5 cpe:/a:mozilla:seamonkey:2.8:beta6 cpe:/a:mozilla:seamonkey:2.9 cpe:/a:mozilla:seamonkey:2.9:beta1 cpe:/a:mozilla:seamonkey:2.9:beta2 cpe:/a:mozilla:seamonkey:2.9:beta3 cpe:/a:mozilla:seamonkey:2.9:beta4 cpe:/a:mozilla:seamonkey:2.9.1 cpe:/a:mozilla:seamonkey:2.10 cpe:/a:mozilla:seamonkey:2.10:beta1 cpe:/a:mozilla:seamonkey:2.10:beta2 cpe:/a:mozilla:seamonkey:2.10:beta3 cpe:/a:mozilla:seamonkey:2.10.1 cpe:/a:mozilla:seamonkey:2.11 cpe:/a:mozilla:seamonkey:2.11:beta1 cpe:/a:mozilla:seamonkey:2.11:beta2 cpe:/a:mozilla:seamonkey:2.11:beta3 cpe:/a:mozilla:seamonkey:2.11:beta4 cpe:/a:mozilla:seamonkey:2.11:beta5 cpe:/a:mozilla:seamonkey:2.11:beta6 cpe:/a:mozilla:seamonkey:2.12 cpe:/a:mozilla:seamonkey:2.12:beta1 cpe:/a:mozilla:seamonkey:2.12:beta2 cpe:/a:mozilla:seamonkey:2.12:beta3 cpe:/a:mozilla:seamonkey:2.12:beta4 cpe:/a:mozilla:seamonkey:2.12:beta5 cpe:/a:mozilla:seamonkey:2.12:beta6 cpe:/a:mozilla:seamonkey:2.12.1 cpe:/a:mozilla:seamonkey:2.13 cpe:/a:mozilla:seamonkey:2.13:beta1 cpe:/a:mozilla:seamonkey:2.13:beta2 cpe:/a:mozilla:seamonkey:2.13:beta3 cpe:/a:mozilla:seamonkey:2.13:beta4 cpe:/a:mozilla:seamonkey:2.13:beta5 cpe:/a:mozilla:seamonkey:2.13:beta6 cpe:/a:mozilla:seamonkey:2.13.1 cpe:/a:mozilla:seamonkey:2.13.2 cpe:/a:mozilla:seamonkey:2.14 cpe:/a:mozilla:seamonkey:2.14:beta1 cpe:/a:mozilla:seamonkey:2.14:beta2 cpe:/a:mozilla:seamonkey:2.14:beta3 cpe:/a:mozilla:seamonkey:2.14:beta4 cpe:/a:mozilla:seamonkey:2.14:beta5 cpe:/a:mozilla:seamonkey:2.14.1 cpe:/a:mozilla:seamonkey:2.15:beta1 cpe:/a:mozilla:seamonkey:2.15:beta2 cpe:/a:mozilla:seamonkey:2.15:beta3 cpe:/a:mozilla:seamonkey:2.15:beta4 cpe:/a:mozilla:seamonkey:2.15:beta5 cpe:/a:mozilla:seamonkey:2.15:beta6 cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.0.8 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 cpe:/a:mozilla:thunderbird:1.5.0.2 cpe:/a:mozilla:thunderbird:1.5.0.3 cpe:/a:mozilla:thunderbird:1.5.0.4 cpe:/a:mozilla:thunderbird:1.5.0.5 cpe:/a:mozilla:thunderbird:1.5.0.6 cpe:/a:mozilla:thunderbird:1.5.0.7 cpe:/a:mozilla:thunderbird:1.5.0.8 cpe:/a:mozilla:thunderbird:1.5.0.9 cpe:/a:mozilla:thunderbird:1.5.0.10 cpe:/a:mozilla:thunderbird:1.5.0.11 cpe:/a:mozilla:thunderbird:1.5.0.12 cpe:/a:mozilla:thunderbird:1.5.0.13 cpe:/a:mozilla:thunderbird:1.5.0.14 cpe:/a:mozilla:thunderbird:1.5.1 cpe:/a:mozilla:thunderbird:1.5.2 cpe:/a:mozilla:thunderbird:1.7.1 cpe:/a:mozilla:thunderbird:1.7.3 cpe:/a:mozilla:thunderbird:2.0 cpe:/a:mozilla:thunderbird:2.0.0.0 cpe:/a:mozilla:thunderbird:2.0.0.1 cpe:/a:mozilla:thunderbird:2.0.0.2 cpe:/a:mozilla:thunderbird:2.0.0.3 cpe:/a:mozilla:thunderbird:2.0.0.4 cpe:/a:mozilla:thunderbird:2.0.0.5 cpe:/a:mozilla:thunderbird:2.0.0.6 cpe:/a:mozilla:thunderbird:2.0.0.7 cpe:/a:mozilla:thunderbird:2.0.0.8 cpe:/a:mozilla:thunderbird:2.0.0.9 cpe:/a:mozilla:thunderbird:2.0.0.11 cpe:/a:mozilla:thunderbird:2.0.0.12 cpe:/a:mozilla:thunderbird:2.0.0.13 cpe:/a:mozilla:thunderbird:2.0.0.14 cpe:/a:mozilla:thunderbird:2.0.0.15 cpe:/a:mozilla:thunderbird:2.0.0.16 cpe:/a:mozilla:thunderbird:2.0.0.17 cpe:/a:mozilla:thunderbird:2.0.0.18 cpe:/a:mozilla:thunderbird:2.0.0.19 cpe:/a:mozilla:thunderbird:2.0.0.20 cpe:/a:mozilla:thunderbird:2.0.0.21 cpe:/a:mozilla:thunderbird:2.0.0.22 cpe:/a:mozilla:thunderbird:2.0.0.23 cpe:/a:mozilla:thunderbird:3.0 cpe:/a:mozilla:thunderbird:3.0.1 cpe:/a:mozilla:thunderbird:3.0.2 cpe:/a:mozilla:thunderbird:3.0.3 cpe:/a:mozilla:thunderbird:3.0.4 cpe:/a:mozilla:thunderbird:3.0.5 cpe:/a:mozilla:thunderbird:3.0.6 cpe:/a:mozilla:thunderbird:3.0.7 cpe:/a:mozilla:thunderbird:3.0.8 cpe:/a:mozilla:thunderbird:3.0.9 cpe:/a:mozilla:thunderbird:3.0.10 cpe:/a:mozilla:thunderbird:3.0.11 cpe:/a:mozilla:thunderbird:3.1 cpe:/a:mozilla:thunderbird:3.1.1 cpe:/a:mozilla:thunderbird:3.1.2 cpe:/a:mozilla:thunderbird:3.1.3 cpe:/a:mozilla:thunderbird:3.1.4 cpe:/a:mozilla:thunderbird:3.1.5 cpe:/a:mozilla:thunderbird:3.1.6 cpe:/a:mozilla:thunderbird:3.1.7 cpe:/a:mozilla:thunderbird:3.1.8 cpe:/a:mozilla:thunderbird:3.1.9 cpe:/a:mozilla:thunderbird:3.1.10 cpe:/a:mozilla:thunderbird:3.1.11 cpe:/a:mozilla:thunderbird:3.1.12 cpe:/a:mozilla:thunderbird:3.1.13 cpe:/a:mozilla:thunderbird:3.1.14 cpe:/a:mozilla:thunderbird:3.1.15 cpe:/a:mozilla:thunderbird:3.1.16 cpe:/a:mozilla:thunderbird:3.1.17 cpe:/a:mozilla:thunderbird:5.0 cpe:/a:mozilla:thunderbird:6.0 cpe:/a:mozilla:thunderbird:6.0.1 cpe:/a:mozilla:thunderbird:6.0.2 cpe:/a:mozilla:thunderbird:7.0 cpe:/a:mozilla:thunderbird:7.0.1 cpe:/a:mozilla:thunderbird:8.0 cpe:/a:mozilla:thunderbird:9.0 cpe:/a:mozilla:thunderbird:9.0.1 cpe:/a:mozilla:thunderbird:10.0 cpe:/a:mozilla:thunderbird:10.0.1 cpe:/a:mozilla:thunderbird:10.0.2 cpe:/a:mozilla:thunderbird:10.0.3 cpe:/a:mozilla:thunderbird:10.0.4 cpe:/a:mozilla:thunderbird:11.0 cpe:/a:mozilla:thunderbird:11.0.1 cpe:/a:mozilla:thunderbird:12.0 cpe:/a:mozilla:thunderbird:12.0.1 cpe:/a:mozilla:thunderbird:13.0 cpe:/a:mozilla:thunderbird:13.0.1 cpe:/a:mozilla:thunderbird:14.0 cpe:/a:mozilla:thunderbird:15.0 cpe:/a:mozilla:thunderbird:15.0.1 cpe:/a:mozilla:thunderbird:16.0 cpe:/a:mozilla:thunderbird:16.0.1 cpe:/a:mozilla:thunderbird:16.0.2 cpe:/a:mozilla:thunderbird:17.0 cpe:/a:mozilla:thunderbird_esr:17.0 cpe:/a:mozilla:thunderbird_esr:17.0.1

CVE-2013-0745

2013-01-13T15:55:01.477-05:00

2017-09-18T21:35:44.903-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-08.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=794158 The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.

CVE-2013-0746

2013-01-13T15:55:01.527-05:00

2017-09-18T21:35:45.060-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 REDHAT RHSA-2013:0144 REDHAT RHSA-2013:0145 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-09.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=816842 Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values, which allows remote attackers to execute arbitrary code or cause a denial of service (compartment mismatch and application crash) via crafted JavaScript code that is not properly handled during garbage collection.

cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox_esr:17.0 cpe:/a:mozilla:firefox_esr:17.0.1 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0::beta cpe:/a:mozilla:seamonkey:1.0::dev cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.99 cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.5:1.1.10 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.11 cpe:/a:mozilla:seamonkey:2.0.12 cpe:/a:mozilla:seamonkey:2.0.13 cpe:/a:mozilla:seamonkey:2.0.14 cpe:/a:mozilla:seamonkey:2.0a1::pre cpe:/a:mozilla:seamonkey:2.0a1pre cpe:/a:mozilla:seamonkey:2.1 cpe:/a:mozilla:seamonkey:2.1:alpha1 cpe:/a:mozilla:seamonkey:2.1:alpha2 cpe:/a:mozilla:seamonkey:2.1:alpha3 cpe:/a:mozilla:seamonkey:2.1:beta1 cpe:/a:mozilla:seamonkey:2.1:beta2 cpe:/a:mozilla:seamonkey:2.1:beta3 cpe:/a:mozilla:seamonkey:2.1:rc1 cpe:/a:mozilla:seamonkey:2.1:rc2 cpe:/a:mozilla:seamonkey:2.2 cpe:/a:mozilla:seamonkey:2.2:beta1 cpe:/a:mozilla:seamonkey:2.2:beta2 cpe:/a:mozilla:seamonkey:2.2:beta3 cpe:/a:mozilla:seamonkey:2.3 cpe:/a:mozilla:seamonkey:2.3:beta1 cpe:/a:mozilla:seamonkey:2.3:beta2 cpe:/a:mozilla:seamonkey:2.3:beta3 cpe:/a:mozilla:seamonkey:2.3.1 cpe:/a:mozilla:seamonkey:2.3.2 cpe:/a:mozilla:seamonkey:2.3.3 cpe:/a:mozilla:seamonkey:2.4 cpe:/a:mozilla:seamonkey:2.4:beta1 cpe:/a:mozilla:seamonkey:2.4:beta2 cpe:/a:mozilla:seamonkey:2.4:beta3 cpe:/a:mozilla:seamonkey:2.4.1 cpe:/a:mozilla:seamonkey:2.5 cpe:/a:mozilla:seamonkey:2.5:beta1 cpe:/a:mozilla:seamonkey:2.5:beta2 cpe:/a:mozilla:seamonkey:2.5:beta3 cpe:/a:mozilla:seamonkey:2.5:beta4 cpe:/a:mozilla:seamonkey:2.6 cpe:/a:mozilla:seamonkey:2.6:beta1 cpe:/a:mozilla:seamonkey:2.6:beta2 cpe:/a:mozilla:seamonkey:2.6:beta3 cpe:/a:mozilla:seamonkey:2.6:beta4 cpe:/a:mozilla:seamonkey:2.6.1 cpe:/a:mozilla:seamonkey:2.7 cpe:/a:mozilla:seamonkey:2.7:beta1 cpe:/a:mozilla:seamonkey:2.7:beta2 cpe:/a:mozilla:seamonkey:2.7:beta3 cpe:/a:mozilla:seamonkey:2.7:beta4 cpe:/a:mozilla:seamonkey:2.7:beta5 cpe:/a:mozilla:seamonkey:2.7.1 cpe:/a:mozilla:seamonkey:2.7.2 cpe:/a:mozilla:seamonkey:2.8 cpe:/a:mozilla:seamonkey:2.8:beta1 cpe:/a:mozilla:seamonkey:2.8:beta2 cpe:/a:mozilla:seamonkey:2.8:beta3 cpe:/a:mozilla:seamonkey:2.8:beta4 cpe:/a:mozilla:seamonkey:2.8:beta5 cpe:/a:mozilla:seamonkey:2.8:beta6 cpe:/a:mozilla:seamonkey:2.9 cpe:/a:mozilla:seamonkey:2.9:beta1 cpe:/a:mozilla:seamonkey:2.9:beta2 cpe:/a:mozilla:seamonkey:2.9:beta3 cpe:/a:mozilla:seamonkey:2.9:beta4 cpe:/a:mozilla:seamonkey:2.9.1 cpe:/a:mozilla:seamonkey:2.10 cpe:/a:mozilla:seamonkey:2.10:beta1 cpe:/a:mozilla:seamonkey:2.10:beta2 cpe:/a:mozilla:seamonkey:2.10:beta3 cpe:/a:mozilla:seamonkey:2.10.1 cpe:/a:mozilla:seamonkey:2.11 cpe:/a:mozilla:seamonkey:2.11:beta1 cpe:/a:mozilla:seamonkey:2.11:beta2 cpe:/a:mozilla:seamonkey:2.11:beta3 cpe:/a:mozilla:seamonkey:2.11:beta4 cpe:/a:mozilla:seamonkey:2.11:beta5 cpe:/a:mozilla:seamonkey:2.11:beta6 cpe:/a:mozilla:seamonkey:2.12 cpe:/a:mozilla:seamonkey:2.12:beta1 cpe:/a:mozilla:seamonkey:2.12:beta2 cpe:/a:mozilla:seamonkey:2.12:beta3 cpe:/a:mozilla:seamonkey:2.12:beta4 cpe:/a:mozilla:seamonkey:2.12:beta5 cpe:/a:mozilla:seamonkey:2.12:beta6 cpe:/a:mozilla:seamonkey:2.12.1 cpe:/a:mozilla:seamonkey:2.13 cpe:/a:mozilla:seamonkey:2.13:beta1 cpe:/a:mozilla:seamonkey:2.13:beta2 cpe:/a:mozilla:seamonkey:2.13:beta3 cpe:/a:mozilla:seamonkey:2.13:beta4 cpe:/a:mozilla:seamonkey:2.13:beta5 cpe:/a:mozilla:seamonkey:2.13:beta6 cpe:/a:mozilla:seamonkey:2.13.1 cpe:/a:mozilla:seamonkey:2.13.2 cpe:/a:mozilla:seamonkey:2.14 cpe:/a:mozilla:seamonkey:2.14:beta1 cpe:/a:mozilla:seamonkey:2.14:beta2 cpe:/a:mozilla:seamonkey:2.14:beta3 cpe:/a:mozilla:seamonkey:2.14:beta4 cpe:/a:mozilla:seamonkey:2.14:beta5 cpe:/a:mozilla:seamonkey:2.14.1 cpe:/a:mozilla:seamonkey:2.15:beta1 cpe:/a:mozilla:seamonkey:2.15:beta2 cpe:/a:mozilla:seamonkey:2.15:beta3 cpe:/a:mozilla:seamonkey:2.15:beta4 cpe:/a:mozilla:seamonkey:2.15:beta5 cpe:/a:mozilla:seamonkey:2.15:beta6 cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.0.8 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 cpe:/a:mozilla:thunderbird:1.5.0.2 cpe:/a:mozilla:thunderbird:1.5.0.3 cpe:/a:mozilla:thunderbird:1.5.0.4 cpe:/a:mozilla:thunderbird:1.5.0.5 cpe:/a:mozilla:thunderbird:1.5.0.6 cpe:/a:mozilla:thunderbird:1.5.0.7 cpe:/a:mozilla:thunderbird:1.5.0.8 cpe:/a:mozilla:thunderbird:1.5.0.9 cpe:/a:mozilla:thunderbird:1.5.0.10 cpe:/a:mozilla:thunderbird:1.5.0.11 cpe:/a:mozilla:thunderbird:1.5.0.12 cpe:/a:mozilla:thunderbird:1.5.0.13 cpe:/a:mozilla:thunderbird:1.5.0.14 cpe:/a:mozilla:thunderbird:1.5.1 cpe:/a:mozilla:thunderbird:1.5.2 cpe:/a:mozilla:thunderbird:1.7.1 cpe:/a:mozilla:thunderbird:1.7.3 cpe:/a:mozilla:thunderbird:2.0 cpe:/a:mozilla:thunderbird:2.0.0.0 cpe:/a:mozilla:thunderbird:2.0.0.1 cpe:/a:mozilla:thunderbird:2.0.0.2 cpe:/a:mozilla:thunderbird:2.0.0.3 cpe:/a:mozilla:thunderbird:2.0.0.4 cpe:/a:mozilla:thunderbird:2.0.0.5 cpe:/a:mozilla:thunderbird:2.0.0.6 cpe:/a:mozilla:thunderbird:2.0.0.7 cpe:/a:mozilla:thunderbird:2.0.0.8 cpe:/a:mozilla:thunderbird:2.0.0.9 cpe:/a:mozilla:thunderbird:2.0.0.11 cpe:/a:mozilla:thunderbird:2.0.0.12 cpe:/a:mozilla:thunderbird:2.0.0.13 cpe:/a:mozilla:thunderbird:2.0.0.14 cpe:/a:mozilla:thunderbird:2.0.0.15 cpe:/a:mozilla:thunderbird:2.0.0.16 cpe:/a:mozilla:thunderbird:2.0.0.17 cpe:/a:mozilla:thunderbird:2.0.0.18 cpe:/a:mozilla:thunderbird:2.0.0.19 cpe:/a:mozilla:thunderbird:2.0.0.20 cpe:/a:mozilla:thunderbird:2.0.0.21 cpe:/a:mozilla:thunderbird:2.0.0.22 cpe:/a:mozilla:thunderbird:2.0.0.23 cpe:/a:mozilla:thunderbird:3.0 cpe:/a:mozilla:thunderbird:3.0.1 cpe:/a:mozilla:thunderbird:3.0.2 cpe:/a:mozilla:thunderbird:3.0.3 cpe:/a:mozilla:thunderbird:3.0.4 cpe:/a:mozilla:thunderbird:3.0.5 cpe:/a:mozilla:thunderbird:3.0.6 cpe:/a:mozilla:thunderbird:3.0.7 cpe:/a:mozilla:thunderbird:3.0.8 cpe:/a:mozilla:thunderbird:3.0.9 cpe:/a:mozilla:thunderbird:3.0.10 cpe:/a:mozilla:thunderbird:3.0.11 cpe:/a:mozilla:thunderbird:3.1 cpe:/a:mozilla:thunderbird:3.1.1 cpe:/a:mozilla:thunderbird:3.1.2 cpe:/a:mozilla:thunderbird:3.1.3 cpe:/a:mozilla:thunderbird:3.1.4 cpe:/a:mozilla:thunderbird:3.1.5 cpe:/a:mozilla:thunderbird:3.1.6 cpe:/a:mozilla:thunderbird:3.1.7 cpe:/a:mozilla:thunderbird:3.1.8 cpe:/a:mozilla:thunderbird:3.1.9 cpe:/a:mozilla:thunderbird:3.1.10 cpe:/a:mozilla:thunderbird:3.1.11 cpe:/a:mozilla:thunderbird:3.1.12 cpe:/a:mozilla:thunderbird:3.1.13 cpe:/a:mozilla:thunderbird:3.1.14 cpe:/a:mozilla:thunderbird:3.1.15 cpe:/a:mozilla:thunderbird:3.1.16 cpe:/a:mozilla:thunderbird:3.1.17 cpe:/a:mozilla:thunderbird:5.0 cpe:/a:mozilla:thunderbird:6.0 cpe:/a:mozilla:thunderbird:6.0.1 cpe:/a:mozilla:thunderbird:6.0.2 cpe:/a:mozilla:thunderbird:7.0 cpe:/a:mozilla:thunderbird:7.0.1 cpe:/a:mozilla:thunderbird:8.0 cpe:/a:mozilla:thunderbird:9.0 cpe:/a:mozilla:thunderbird:9.0.1 cpe:/a:mozilla:thunderbird:10.0 cpe:/a:mozilla:thunderbird:10.0.1 cpe:/a:mozilla:thunderbird:10.0.2 cpe:/a:mozilla:thunderbird:10.0.3 cpe:/a:mozilla:thunderbird:10.0.4 cpe:/a:mozilla:thunderbird:11.0 cpe:/a:mozilla:thunderbird:11.0.1 cpe:/a:mozilla:thunderbird:12.0 cpe:/a:mozilla:thunderbird:12.0.1 cpe:/a:mozilla:thunderbird:13.0 cpe:/a:mozilla:thunderbird:13.0.1 cpe:/a:mozilla:thunderbird:14.0 cpe:/a:mozilla:thunderbird:15.0 cpe:/a:mozilla:thunderbird:15.0.1 cpe:/a:mozilla:thunderbird:16.0 cpe:/a:mozilla:thunderbird:16.0.1 cpe:/a:mozilla:thunderbird:16.0.2 cpe:/a:mozilla:thunderbird:17.0 cpe:/a:mozilla:thunderbird_esr:17.0 cpe:/a:mozilla:thunderbird_esr:17.0.1

CVE-2013-0747

2013-01-13T15:55:01.570-05:00

2017-09-18T21:35:45.217-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-10.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=733305 The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event.

CVE-2013-0748

2013-01-13T15:55:01.617-05:00

2017-09-18T21:35:45.373-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 REDHAT RHSA-2013:0144 REDHAT RHSA-2013:0145 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-11.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=806031 The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR protection mechanism by calling the toString function of an XBL object.

cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox_esr:10.0 cpe:/a:mozilla:firefox_esr:10.0.1 cpe:/a:mozilla:firefox_esr:10.0.2 cpe:/a:mozilla:firefox_esr:10.0.3 cpe:/a:mozilla:firefox_esr:10.0.4 cpe:/a:mozilla:firefox_esr:10.0.5 cpe:/a:mozilla:firefox_esr:10.0.6 cpe:/a:mozilla:firefox_esr:10.0.7 cpe:/a:mozilla:firefox_esr:10.0.8 cpe:/a:mozilla:firefox_esr:10.0.9 cpe:/a:mozilla:firefox_esr:10.0.10 cpe:/a:mozilla:firefox_esr:10.0.11 cpe:/a:mozilla:firefox_esr:17.0 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0::beta cpe:/a:mozilla:seamonkey:1.0::dev cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.99 cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.5:1.1.10 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.11 cpe:/a:mozilla:seamonkey:2.0.12 cpe:/a:mozilla:seamonkey:2.0.13 cpe:/a:mozilla:seamonkey:2.0.14 cpe:/a:mozilla:seamonkey:2.0a1::pre cpe:/a:mozilla:seamonkey:2.0a1pre cpe:/a:mozilla:seamonkey:2.1 cpe:/a:mozilla:seamonkey:2.1:alpha1 cpe:/a:mozilla:seamonkey:2.1:alpha2 cpe:/a:mozilla:seamonkey:2.1:alpha3 cpe:/a:mozilla:seamonkey:2.1:beta1 cpe:/a:mozilla:seamonkey:2.1:beta2 cpe:/a:mozilla:seamonkey:2.1:beta3 cpe:/a:mozilla:seamonkey:2.1:rc1 cpe:/a:mozilla:seamonkey:2.1:rc2 cpe:/a:mozilla:seamonkey:2.2 cpe:/a:mozilla:seamonkey:2.2:beta1 cpe:/a:mozilla:seamonkey:2.2:beta2 cpe:/a:mozilla:seamonkey:2.2:beta3 cpe:/a:mozilla:seamonkey:2.3 cpe:/a:mozilla:seamonkey:2.3:beta1 cpe:/a:mozilla:seamonkey:2.3:beta2 cpe:/a:mozilla:seamonkey:2.3:beta3 cpe:/a:mozilla:seamonkey:2.3.1 cpe:/a:mozilla:seamonkey:2.3.2 cpe:/a:mozilla:seamonkey:2.3.3 cpe:/a:mozilla:seamonkey:2.4 cpe:/a:mozilla:seamonkey:2.4:beta1 cpe:/a:mozilla:seamonkey:2.4:beta2 cpe:/a:mozilla:seamonkey:2.4:beta3 cpe:/a:mozilla:seamonkey:2.4.1 cpe:/a:mozilla:seamonkey:2.5 cpe:/a:mozilla:seamonkey:2.5:beta1 cpe:/a:mozilla:seamonkey:2.5:beta2 cpe:/a:mozilla:seamonkey:2.5:beta3 cpe:/a:mozilla:seamonkey:2.5:beta4 cpe:/a:mozilla:seamonkey:2.6 cpe:/a:mozilla:seamonkey:2.6:beta1 cpe:/a:mozilla:seamonkey:2.6:beta2 cpe:/a:mozilla:seamonkey:2.6:beta3 cpe:/a:mozilla:seamonkey:2.6:beta4 cpe:/a:mozilla:seamonkey:2.6.1 cpe:/a:mozilla:seamonkey:2.7 cpe:/a:mozilla:seamonkey:2.7:beta1 cpe:/a:mozilla:seamonkey:2.7:beta2 cpe:/a:mozilla:seamonkey:2.7:beta3 cpe:/a:mozilla:seamonkey:2.7:beta4 cpe:/a:mozilla:seamonkey:2.7:beta5 cpe:/a:mozilla:seamonkey:2.7.1 cpe:/a:mozilla:seamonkey:2.7.2 cpe:/a:mozilla:seamonkey:2.8 cpe:/a:mozilla:seamonkey:2.8:beta1 cpe:/a:mozilla:seamonkey:2.8:beta2 cpe:/a:mozilla:seamonkey:2.8:beta3 cpe:/a:mozilla:seamonkey:2.8:beta4 cpe:/a:mozilla:seamonkey:2.8:beta5 cpe:/a:mozilla:seamonkey:2.8:beta6 cpe:/a:mozilla:seamonkey:2.9 cpe:/a:mozilla:seamonkey:2.9:beta1 cpe:/a:mozilla:seamonkey:2.9:beta2 cpe:/a:mozilla:seamonkey:2.9:beta3 cpe:/a:mozilla:seamonkey:2.9:beta4 cpe:/a:mozilla:seamonkey:2.9.1 cpe:/a:mozilla:seamonkey:2.10 cpe:/a:mozilla:seamonkey:2.10:beta1 cpe:/a:mozilla:seamonkey:2.10:beta2 cpe:/a:mozilla:seamonkey:2.10:beta3 cpe:/a:mozilla:seamonkey:2.10.1 cpe:/a:mozilla:seamonkey:2.11 cpe:/a:mozilla:seamonkey:2.11:beta1 cpe:/a:mozilla:seamonkey:2.11:beta2 cpe:/a:mozilla:seamonkey:2.11:beta3 cpe:/a:mozilla:seamonkey:2.11:beta4 cpe:/a:mozilla:seamonkey:2.11:beta5 cpe:/a:mozilla:seamonkey:2.11:beta6 cpe:/a:mozilla:seamonkey:2.12 cpe:/a:mozilla:seamonkey:2.12:beta1 cpe:/a:mozilla:seamonkey:2.12:beta2 cpe:/a:mozilla:seamonkey:2.12:beta3 cpe:/a:mozilla:seamonkey:2.12:beta4 cpe:/a:mozilla:seamonkey:2.12:beta5 cpe:/a:mozilla:seamonkey:2.12:beta6 cpe:/a:mozilla:seamonkey:2.12.1 cpe:/a:mozilla:seamonkey:2.13 cpe:/a:mozilla:seamonkey:2.13:beta1 cpe:/a:mozilla:seamonkey:2.13:beta2 cpe:/a:mozilla:seamonkey:2.13:beta3 cpe:/a:mozilla:seamonkey:2.13:beta4 cpe:/a:mozilla:seamonkey:2.13:beta5 cpe:/a:mozilla:seamonkey:2.13:beta6 cpe:/a:mozilla:seamonkey:2.13.1 cpe:/a:mozilla:seamonkey:2.13.2 cpe:/a:mozilla:seamonkey:2.14 cpe:/a:mozilla:seamonkey:2.14:beta1 cpe:/a:mozilla:seamonkey:2.14:beta2 cpe:/a:mozilla:seamonkey:2.14:beta3 cpe:/a:mozilla:seamonkey:2.14:beta4 cpe:/a:mozilla:seamonkey:2.14:beta5 cpe:/a:mozilla:seamonkey:2.14.1 cpe:/a:mozilla:seamonkey:2.15:beta1 cpe:/a:mozilla:seamonkey:2.15:beta2 cpe:/a:mozilla:seamonkey:2.15:beta3 cpe:/a:mozilla:seamonkey:2.15:beta4 cpe:/a:mozilla:seamonkey:2.15:beta5 cpe:/a:mozilla:seamonkey:2.15:beta6 cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.0.8 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 cpe:/a:mozilla:thunderbird:1.5.0.2 cpe:/a:mozilla:thunderbird:1.5.0.3 cpe:/a:mozilla:thunderbird:1.5.0.4 cpe:/a:mozilla:thunderbird:1.5.0.5 cpe:/a:mozilla:thunderbird:1.5.0.6 cpe:/a:mozilla:thunderbird:1.5.0.7 cpe:/a:mozilla:thunderbird:1.5.0.8 cpe:/a:mozilla:thunderbird:1.5.0.9 cpe:/a:mozilla:thunderbird:1.5.0.10 cpe:/a:mozilla:thunderbird:1.5.0.11 cpe:/a:mozilla:thunderbird:1.5.0.12 cpe:/a:mozilla:thunderbird:1.5.0.13 cpe:/a:mozilla:thunderbird:1.5.0.14 cpe:/a:mozilla:thunderbird:1.5.1 cpe:/a:mozilla:thunderbird:1.5.2 cpe:/a:mozilla:thunderbird:1.7.1 cpe:/a:mozilla:thunderbird:1.7.3 cpe:/a:mozilla:thunderbird:2.0 cpe:/a:mozilla:thunderbird:2.0.0.0 cpe:/a:mozilla:thunderbird:2.0.0.1 cpe:/a:mozilla:thunderbird:2.0.0.2 cpe:/a:mozilla:thunderbird:2.0.0.3 cpe:/a:mozilla:thunderbird:2.0.0.4 cpe:/a:mozilla:thunderbird:2.0.0.5 cpe:/a:mozilla:thunderbird:2.0.0.6 cpe:/a:mozilla:thunderbird:2.0.0.7 cpe:/a:mozilla:thunderbird:2.0.0.8 cpe:/a:mozilla:thunderbird:2.0.0.9 cpe:/a:mozilla:thunderbird:2.0.0.11 cpe:/a:mozilla:thunderbird:2.0.0.12 cpe:/a:mozilla:thunderbird:2.0.0.13 cpe:/a:mozilla:thunderbird:2.0.0.14 cpe:/a:mozilla:thunderbird:2.0.0.15 cpe:/a:mozilla:thunderbird:2.0.0.16 cpe:/a:mozilla:thunderbird:2.0.0.17 cpe:/a:mozilla:thunderbird:2.0.0.18 cpe:/a:mozilla:thunderbird:2.0.0.19 cpe:/a:mozilla:thunderbird:2.0.0.20 cpe:/a:mozilla:thunderbird:2.0.0.21 cpe:/a:mozilla:thunderbird:2.0.0.22 cpe:/a:mozilla:thunderbird:2.0.0.23 cpe:/a:mozilla:thunderbird:3.0 cpe:/a:mozilla:thunderbird:3.0.1 cpe:/a:mozilla:thunderbird:3.0.2 cpe:/a:mozilla:thunderbird:3.0.3 cpe:/a:mozilla:thunderbird:3.0.4 cpe:/a:mozilla:thunderbird:3.0.5 cpe:/a:mozilla:thunderbird:3.0.6 cpe:/a:mozilla:thunderbird:3.0.7 cpe:/a:mozilla:thunderbird:3.0.8 cpe:/a:mozilla:thunderbird:3.0.9 cpe:/a:mozilla:thunderbird:3.0.10 cpe:/a:mozilla:thunderbird:3.0.11 cpe:/a:mozilla:thunderbird:3.1 cpe:/a:mozilla:thunderbird:3.1.1 cpe:/a:mozilla:thunderbird:3.1.2 cpe:/a:mozilla:thunderbird:3.1.3 cpe:/a:mozilla:thunderbird:3.1.4 cpe:/a:mozilla:thunderbird:3.1.5 cpe:/a:mozilla:thunderbird:3.1.6 cpe:/a:mozilla:thunderbird:3.1.7 cpe:/a:mozilla:thunderbird:3.1.8 cpe:/a:mozilla:thunderbird:3.1.9 cpe:/a:mozilla:thunderbird:3.1.10 cpe:/a:mozilla:thunderbird:3.1.11 cpe:/a:mozilla:thunderbird:3.1.12 cpe:/a:mozilla:thunderbird:3.1.13 cpe:/a:mozilla:thunderbird:3.1.14 cpe:/a:mozilla:thunderbird:3.1.15 cpe:/a:mozilla:thunderbird:3.1.16 cpe:/a:mozilla:thunderbird:3.1.17 cpe:/a:mozilla:thunderbird:5.0 cpe:/a:mozilla:thunderbird:6.0 cpe:/a:mozilla:thunderbird:6.0.1 cpe:/a:mozilla:thunderbird:6.0.2 cpe:/a:mozilla:thunderbird:7.0 cpe:/a:mozilla:thunderbird:7.0.1 cpe:/a:mozilla:thunderbird:8.0 cpe:/a:mozilla:thunderbird:9.0 cpe:/a:mozilla:thunderbird:9.0.1 cpe:/a:mozilla:thunderbird:10.0 cpe:/a:mozilla:thunderbird:10.0.1 cpe:/a:mozilla:thunderbird:10.0.2 cpe:/a:mozilla:thunderbird:10.0.3 cpe:/a:mozilla:thunderbird:10.0.4 cpe:/a:mozilla:thunderbird:11.0 cpe:/a:mozilla:thunderbird:11.0.1 cpe:/a:mozilla:thunderbird:12.0 cpe:/a:mozilla:thunderbird:12.0.1 cpe:/a:mozilla:thunderbird:13.0 cpe:/a:mozilla:thunderbird:13.0.1 cpe:/a:mozilla:thunderbird:14.0 cpe:/a:mozilla:thunderbird:15.0 cpe:/a:mozilla:thunderbird:15.0.1 cpe:/a:mozilla:thunderbird:16.0 cpe:/a:mozilla:thunderbird:16.0.1 cpe:/a:mozilla:thunderbird:16.0.2 cpe:/a:mozilla:thunderbird:17.0 cpe:/a:mozilla:thunderbird_esr:10.0 cpe:/a:mozilla:thunderbird_esr:10.0.1 cpe:/a:mozilla:thunderbird_esr:10.0.2 cpe:/a:mozilla:thunderbird_esr:10.0.3 cpe:/a:mozilla:thunderbird_esr:10.0.4 cpe:/a:mozilla:thunderbird_esr:10.0.5 cpe:/a:mozilla:thunderbird_esr:10.0.6 cpe:/a:mozilla:thunderbird_esr:10.0.7 cpe:/a:mozilla:thunderbird_esr:10.0.8 cpe:/a:mozilla:thunderbird_esr:10.0.9 cpe:/a:mozilla:thunderbird_esr:10.0.10 cpe:/a:mozilla:thunderbird_esr:10.0.11 cpe:/a:mozilla:thunderbird_esr:17.0

CVE-2013-0749

2013-01-13T15:55:01.667-05:00

2017-09-18T21:35:45.513-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-01.html CONFIRM http://www.palemoon.org/releasenotes-ng.shtml UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=785358 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=794426 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=805745 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=805814 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=808481 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=812847 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=814407 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=814839 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=816994 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2013-0750

2013-01-13T15:55:01.713-05:00

2017-09-18T21:35:45.667-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 REDHAT RHSA-2013:0144 REDHAT RHSA-2013:0145 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-12.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=805121 Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted string concatenation, leading to improper memory allocation and a heap-based buffer overflow.

CVE-2013-0751

2013-01-13T15:55:01.760-05:00

2017-09-18T21:35:45.777-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-06.html CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=790454 Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a single IFRAME element, which allows remote attackers to obtain sensitive information or possibly conduct cross-site scripting (XSS) attacks via a crafted HTML document.

cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox_esr:17.0 cpe:/a:mozilla:firefox_esr:17.0.1 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0::beta cpe:/a:mozilla:seamonkey:1.0::dev cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.99 cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.5:1.1.10 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.11 cpe:/a:mozilla:seamonkey:2.0.12 cpe:/a:mozilla:seamonkey:2.0.13 cpe:/a:mozilla:seamonkey:2.0.14 cpe:/a:mozilla:seamonkey:2.0a1::pre cpe:/a:mozilla:seamonkey:2.0a1pre cpe:/a:mozilla:seamonkey:2.1 cpe:/a:mozilla:seamonkey:2.1:alpha1 cpe:/a:mozilla:seamonkey:2.1:alpha2 cpe:/a:mozilla:seamonkey:2.1:alpha3 cpe:/a:mozilla:seamonkey:2.1:beta1 cpe:/a:mozilla:seamonkey:2.1:beta2 cpe:/a:mozilla:seamonkey:2.1:beta3 cpe:/a:mozilla:seamonkey:2.1:rc1 cpe:/a:mozilla:seamonkey:2.1:rc2 cpe:/a:mozilla:seamonkey:2.2 cpe:/a:mozilla:seamonkey:2.2:beta1 cpe:/a:mozilla:seamonkey:2.2:beta2 cpe:/a:mozilla:seamonkey:2.2:beta3 cpe:/a:mozilla:seamonkey:2.3 cpe:/a:mozilla:seamonkey:2.3:beta1 cpe:/a:mozilla:seamonkey:2.3:beta2 cpe:/a:mozilla:seamonkey:2.3:beta3 cpe:/a:mozilla:seamonkey:2.3.1 cpe:/a:mozilla:seamonkey:2.3.2 cpe:/a:mozilla:seamonkey:2.3.3 cpe:/a:mozilla:seamonkey:2.4 cpe:/a:mozilla:seamonkey:2.4:beta1 cpe:/a:mozilla:seamonkey:2.4:beta2 cpe:/a:mozilla:seamonkey:2.4:beta3 cpe:/a:mozilla:seamonkey:2.4.1 cpe:/a:mozilla:seamonkey:2.5 cpe:/a:mozilla:seamonkey:2.5:beta1 cpe:/a:mozilla:seamonkey:2.5:beta2 cpe:/a:mozilla:seamonkey:2.5:beta3 cpe:/a:mozilla:seamonkey:2.5:beta4 cpe:/a:mozilla:seamonkey:2.6 cpe:/a:mozilla:seamonkey:2.6:beta1 cpe:/a:mozilla:seamonkey:2.6:beta2 cpe:/a:mozilla:seamonkey:2.6:beta3 cpe:/a:mozilla:seamonkey:2.6:beta4 cpe:/a:mozilla:seamonkey:2.6.1 cpe:/a:mozilla:seamonkey:2.7 cpe:/a:mozilla:seamonkey:2.7:beta1 cpe:/a:mozilla:seamonkey:2.7:beta2 cpe:/a:mozilla:seamonkey:2.7:beta3 cpe:/a:mozilla:seamonkey:2.7:beta4 cpe:/a:mozilla:seamonkey:2.7:beta5 cpe:/a:mozilla:seamonkey:2.7.1 cpe:/a:mozilla:seamonkey:2.7.2 cpe:/a:mozilla:seamonkey:2.8 cpe:/a:mozilla:seamonkey:2.8:beta1 cpe:/a:mozilla:seamonkey:2.8:beta2 cpe:/a:mozilla:seamonkey:2.8:beta3 cpe:/a:mozilla:seamonkey:2.8:beta4 cpe:/a:mozilla:seamonkey:2.8:beta5 cpe:/a:mozilla:seamonkey:2.8:beta6 cpe:/a:mozilla:seamonkey:2.9 cpe:/a:mozilla:seamonkey:2.9:beta1 cpe:/a:mozilla:seamonkey:2.9:beta2 cpe:/a:mozilla:seamonkey:2.9:beta3 cpe:/a:mozilla:seamonkey:2.9:beta4 cpe:/a:mozilla:seamonkey:2.9.1 cpe:/a:mozilla:seamonkey:2.10 cpe:/a:mozilla:seamonkey:2.10:beta1 cpe:/a:mozilla:seamonkey:2.10:beta2 cpe:/a:mozilla:seamonkey:2.10:beta3 cpe:/a:mozilla:seamonkey:2.10.1 cpe:/a:mozilla:seamonkey:2.11 cpe:/a:mozilla:seamonkey:2.11:beta1 cpe:/a:mozilla:seamonkey:2.11:beta2 cpe:/a:mozilla:seamonkey:2.11:beta3 cpe:/a:mozilla:seamonkey:2.11:beta4 cpe:/a:mozilla:seamonkey:2.11:beta5 cpe:/a:mozilla:seamonkey:2.11:beta6 cpe:/a:mozilla:seamonkey:2.12 cpe:/a:mozilla:seamonkey:2.12:beta1 cpe:/a:mozilla:seamonkey:2.12:beta2 cpe:/a:mozilla:seamonkey:2.12:beta3 cpe:/a:mozilla:seamonkey:2.12:beta4 cpe:/a:mozilla:seamonkey:2.12:beta5 cpe:/a:mozilla:seamonkey:2.12:beta6 cpe:/a:mozilla:seamonkey:2.12.1 cpe:/a:mozilla:seamonkey:2.13 cpe:/a:mozilla:seamonkey:2.13:beta1 cpe:/a:mozilla:seamonkey:2.13:beta2 cpe:/a:mozilla:seamonkey:2.13:beta3 cpe:/a:mozilla:seamonkey:2.13:beta4 cpe:/a:mozilla:seamonkey:2.13:beta5 cpe:/a:mozilla:seamonkey:2.13:beta6 cpe:/a:mozilla:seamonkey:2.13.1 cpe:/a:mozilla:seamonkey:2.13.2 cpe:/a:mozilla:seamonkey:2.14 cpe:/a:mozilla:seamonkey:2.14:beta1 cpe:/a:mozilla:seamonkey:2.14:beta2 cpe:/a:mozilla:seamonkey:2.14:beta3 cpe:/a:mozilla:seamonkey:2.14:beta4 cpe:/a:mozilla:seamonkey:2.14:beta5 cpe:/a:mozilla:seamonkey:2.14.1 cpe:/a:mozilla:seamonkey:2.15:beta1 cpe:/a:mozilla:seamonkey:2.15:beta2 cpe:/a:mozilla:seamonkey:2.15:beta3 cpe:/a:mozilla:seamonkey:2.15:beta4 cpe:/a:mozilla:seamonkey:2.15:beta5 cpe:/a:mozilla:seamonkey:2.15:beta6 cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.0.8 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 cpe:/a:mozilla:thunderbird:1.5.0.2 cpe:/a:mozilla:thunderbird:1.5.0.3 cpe:/a:mozilla:thunderbird:1.5.0.4 cpe:/a:mozilla:thunderbird:1.5.0.5 cpe:/a:mozilla:thunderbird:1.5.0.6 cpe:/a:mozilla:thunderbird:1.5.0.7 cpe:/a:mozilla:thunderbird:1.5.0.8 cpe:/a:mozilla:thunderbird:1.5.0.9 cpe:/a:mozilla:thunderbird:1.5.0.10 cpe:/a:mozilla:thunderbird:1.5.0.11 cpe:/a:mozilla:thunderbird:1.5.0.12 cpe:/a:mozilla:thunderbird:1.5.0.13 cpe:/a:mozilla:thunderbird:1.5.0.14 cpe:/a:mozilla:thunderbird:1.5.1 cpe:/a:mozilla:thunderbird:1.5.2 cpe:/a:mozilla:thunderbird:1.7.1 cpe:/a:mozilla:thunderbird:1.7.3 cpe:/a:mozilla:thunderbird:2.0 cpe:/a:mozilla:thunderbird:2.0.0.0 cpe:/a:mozilla:thunderbird:2.0.0.1 cpe:/a:mozilla:thunderbird:2.0.0.2 cpe:/a:mozilla:thunderbird:2.0.0.3 cpe:/a:mozilla:thunderbird:2.0.0.4 cpe:/a:mozilla:thunderbird:2.0.0.5 cpe:/a:mozilla:thunderbird:2.0.0.6 cpe:/a:mozilla:thunderbird:2.0.0.7 cpe:/a:mozilla:thunderbird:2.0.0.8 cpe:/a:mozilla:thunderbird:2.0.0.9 cpe:/a:mozilla:thunderbird:2.0.0.11 cpe:/a:mozilla:thunderbird:2.0.0.12 cpe:/a:mozilla:thunderbird:2.0.0.13 cpe:/a:mozilla:thunderbird:2.0.0.14 cpe:/a:mozilla:thunderbird:2.0.0.15 cpe:/a:mozilla:thunderbird:2.0.0.16 cpe:/a:mozilla:thunderbird:2.0.0.17 cpe:/a:mozilla:thunderbird:2.0.0.18 cpe:/a:mozilla:thunderbird:2.0.0.19 cpe:/a:mozilla:thunderbird:2.0.0.20 cpe:/a:mozilla:thunderbird:2.0.0.21 cpe:/a:mozilla:thunderbird:2.0.0.22 cpe:/a:mozilla:thunderbird:2.0.0.23 cpe:/a:mozilla:thunderbird:3.0 cpe:/a:mozilla:thunderbird:3.0.1 cpe:/a:mozilla:thunderbird:3.0.2 cpe:/a:mozilla:thunderbird:3.0.3 cpe:/a:mozilla:thunderbird:3.0.4 cpe:/a:mozilla:thunderbird:3.0.5 cpe:/a:mozilla:thunderbird:3.0.6 cpe:/a:mozilla:thunderbird:3.0.7 cpe:/a:mozilla:thunderbird:3.0.8 cpe:/a:mozilla:thunderbird:3.0.9 cpe:/a:mozilla:thunderbird:3.0.10 cpe:/a:mozilla:thunderbird:3.0.11 cpe:/a:mozilla:thunderbird:3.1 cpe:/a:mozilla:thunderbird:3.1.1 cpe:/a:mozilla:thunderbird:3.1.2 cpe:/a:mozilla:thunderbird:3.1.3 cpe:/a:mozilla:thunderbird:3.1.4 cpe:/a:mozilla:thunderbird:3.1.5 cpe:/a:mozilla:thunderbird:3.1.6 cpe:/a:mozilla:thunderbird:3.1.7 cpe:/a:mozilla:thunderbird:3.1.8 cpe:/a:mozilla:thunderbird:3.1.9 cpe:/a:mozilla:thunderbird:3.1.10 cpe:/a:mozilla:thunderbird:3.1.11 cpe:/a:mozilla:thunderbird:3.1.12 cpe:/a:mozilla:thunderbird:3.1.13 cpe:/a:mozilla:thunderbird:3.1.14 cpe:/a:mozilla:thunderbird:3.1.15 cpe:/a:mozilla:thunderbird:3.1.16 cpe:/a:mozilla:thunderbird:3.1.17 cpe:/a:mozilla:thunderbird:5.0 cpe:/a:mozilla:thunderbird:6.0 cpe:/a:mozilla:thunderbird:6.0.1 cpe:/a:mozilla:thunderbird:6.0.2 cpe:/a:mozilla:thunderbird:7.0 cpe:/a:mozilla:thunderbird:7.0.1 cpe:/a:mozilla:thunderbird:8.0 cpe:/a:mozilla:thunderbird:9.0 cpe:/a:mozilla:thunderbird:9.0.1 cpe:/a:mozilla:thunderbird:10.0 cpe:/a:mozilla:thunderbird:10.0.1 cpe:/a:mozilla:thunderbird:10.0.2 cpe:/a:mozilla:thunderbird:10.0.3 cpe:/a:mozilla:thunderbird:10.0.4 cpe:/a:mozilla:thunderbird:11.0 cpe:/a:mozilla:thunderbird:11.0.1 cpe:/a:mozilla:thunderbird:12.0 cpe:/a:mozilla:thunderbird:12.0.1 cpe:/a:mozilla:thunderbird:13.0 cpe:/a:mozilla:thunderbird:13.0.1 cpe:/a:mozilla:thunderbird:14.0 cpe:/a:mozilla:thunderbird:15.0 cpe:/a:mozilla:thunderbird:15.0.1 cpe:/a:mozilla:thunderbird:16.0 cpe:/a:mozilla:thunderbird:16.0.1 cpe:/a:mozilla:thunderbird:16.0.2 cpe:/a:mozilla:thunderbird:17.0 cpe:/a:mozilla:thunderbird_esr:17.0 cpe:/a:mozilla:thunderbird_esr:17.0.1

CVE-2013-0752

2013-01-13T15:55:01.807-05:00

2017-09-18T21:35:45.903-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-13.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=805024 Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.

CVE-2013-0753

2013-01-13T15:55:01.853-05:00

2017-09-18T21:35:46.043-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2013:0048 SUSE SUSE-SU-2013:0049 SUSE openSUSE-SU-2013:0131 SUSE openSUSE-SU-2013:0149 REDHAT RHSA-2013:0144 REDHAT RHSA-2013:0145 CONFIRM http://www.mozilla.org/security/announce/2013/mfsa2013-16.html UBUNTU USN-1681-1 UBUNTU USN-1681-2 UBUNTU USN-1681-4 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=814001 Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.