CVE-2013-2207: Undefined Security Weakness

ptchown in GNU C Library aka glibc or libc6 before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system...

CVE-2013-4257: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4256. Reason: This issue was MERGED into CVE-2013-4256 because it is the same type of vulnerability. Notes: All CVE users should reference CVE-2013-4256 instead of this candidate. All references and descriptions in this...

CVE-2013-3894: Improper Control of Generation of Code

The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in a TrueType font T...

CVE-2013-5091: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559...

CVE-2013-1062: Undefined Security Weakness

ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...

CVE-2013-4288: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...

CVE-2013-5503: Undefined Security Weakness

The UDP process in Cisco IOS XR 4.3.1 does not free packet memory upon detecting full packet queues, which allows remote attackers to cause a denial of service memory consumption via UDP packets to listening ports, aka Bug ID CSCue69413...

CVE-2011-4385: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011. Notes: none...

CVE-2013-5975: Undefined Security Weakness

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2013-5383: Undefined Security Weakness

IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5382...

CVE-2013-5693: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor...

CVE-2013-4239: Improper Restriction of Operations within the Bounds of a Memory Buffer

The xenDaemonListDefinedDomains function in xen/xendinternal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service memory corruption and crash via vectors involving the virConnectListDefinedDomains API function...

CVE-2013-5161: Undefined Security Weakness

Passcode Lock in Apple iOS before 7.0.2 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement, and open the Camera app or read the list of all recently opened apps, by leveraging unspecified transition errors...

CVE-2013-5403: Undefined Security Weakness

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors...

CVE-2013-2026: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4971. Reason: This candidate is a reservation duplicate of CVE-2011-4971. Notes: All CVE users should reference CVE-2011-4971 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2013-5933: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the subE110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service memory corruption by writing a long string to the /dev/socket/initrunit...

CVE-2012-2624: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Logica HotScan allows remote attackers to cause a denial of service crash via a crafted packet...

CVE-2013-5158: Undefined Security Weakness

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

CVE-2013-1036: Improper Restriction of Operations within the Bounds of a Memory Buffer

Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML document...

CVE-2013-5145: Undefined Security Weakness

kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to 1 load or 2 unload kernel extensions via a crafted message...

CVE-2013-5153: Undefined Security Weakness

Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows physically proximate attackers to read notifications via unspecified vectors...

CVE-2013-1718: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service memory corruption and application...

CVE-2013-5627: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA. Notes: The posting will later have IDs assigned in accordance with CVE content decisions...

CVE-2013-1026: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted JPEG2000 data in a PDF document...

CVE-2013-1030: Exposure of Sensitive Information to an Unauthorized Actor

mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line, which allows local users to obtain sensitive information by listing the process...

CVE-2013-2794: Improper Restriction of Operations within the Bounds of a Memory Buffer

Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service infinite loop via crafted input over a serial line...

CVE-2013-1117: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the exception handler in Cisco WebEx Recording Format WRF player T27 LD before SP32 EP16, T27 L10N before SP32ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted WRF file, aka Bug ID...

CVE-2012-6605: Improper Neutralization of Special Elements used in an OS Command

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896...

CVE-2012-6591: Improper Neutralization of Special Elements used in an OS Command

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116...

CVE-2013-3472: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Enterprise License Manager ELM in Cisco Unified Communications Manager CM allows remote attackers to hijack the authentication of arbitrary users for requests that make ELM modifications, aka Bug ID CSCui58210...

CVE-2012-6588: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in links.php in MYRE Business Directory allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2013-5569: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2194: Undefined Security Weakness

Multiple integer overflows in the Elf parser libelf in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel...

CVE-2013-5320: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers to inject arbitrary web script or HTML via the txtSubject parameter...

CVE-2013-2160: Undefined Security Weakness

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service CPU and memory consumption via crafted XML with a large number of 1 elements, 2 attributes, 3 nested constructs, and possibly other vectors...

CVE-2013-5309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in install/forumdata/src/customfields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from...

CVE-2013-5121: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PHPFox before 3.6.0 build6 allows remote attackers to execute arbitrary SQL commands via the searchsortby parameter to user/browse/view/...

CVE-2013-4600: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

CVE-2013-4124: Undefined Security Weakness

Integer overflow in the readnttransealist function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service memory consumption via a malformed packet...

CVE-2013-3956: Undefined Security Weakness

The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista and Windows Server 2008; and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 allows local users to gain privileges...

CVE-2013-1616: Improper Neutralization of Special Elements used in an OS Command

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...

CVE-2013-4925: Undefined Security Weakness

Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service assertion failure and daemon exit via a crafted packet...

CVE-2013-4928: Undefined Security Weakness

Integer signedness error in the dissectheaders function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service infinite loop via a crafted packet...

CVE-2013-2359: Undefined Security Weakness

Unspecified vulnerability in HP System Management Homepage SMH before 7.2.1 allows remote authenticated users to cause a denial of service via unknown vectors, a different vulnerability than CVE-2013-2357, CVE-2013-2358, and CVE-2013-2360...

CVE-2012-3414: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the...

CVE-2013-3436: Undefined Security Weakness

The default configuration of the Group Encrypted Transport VPN GET VPN feature on Cisco IOS uses an improper mechanism for enabling Group Domain of Interpretation GDOI traffic flow, which allows remote attackers to bypass the encryption policy via certain uses of UDP port 848, aka Bug ID CSCui076...

CVE-2013-3798: Undefined Security Weakness

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote attackers to affect integrity and availability via unknown vectors related to MemCached...

CVE-2013-3770: Undefined Security Weakness

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1, 11.1.1.6.0, and 11.1.1.7.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Content Server. NOTE: the previous information is from th...

CVE-2013-3163: Out-of-bounds Write

Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151...

CVE-2013-2874: Undefined Security Weakness

Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access to screen data via vectors involving IPC transmission of GL textures...