[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0284.

[Assistant] Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0284?

[Assistant] {'name': '[oss-security] 20130213 Some rubygems related CVEs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/304'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://newrelic.com/docs/ruby/ruby-agent-security-notification'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0284?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0285 mean in the context of cybersecurity?

[Assistant] CVE-2013-0285


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0285.

[Assistant] The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0285?

[Assistant] {'name': '[oss-security] 20130213 Some rubygems related CVEs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q1/304'}, {'tags': ['x_refsource_MISC'], 'url': 'https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0285?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0286 mean in the context of cybersecurity?

[Assistant] CVE-2013-0286


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0286.

[Assistant] Pinboard 1.0.6 theme for Wordpress has XSS.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0286?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/14/4'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0286?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0287 mean in the context of cybersecurity?

[Assistant] CVE-2013-0287


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0287.

[Assistant] The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0287?

[Assistant] {'name': 'openSUSE-SU-2013:0559', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00115.html'}, {'name': '52704', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52704'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938'}, {'name': '[sssd-devel] 20130319 [SSSD] A security bug in SSSD 1.9 (CVE-2013-0287)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.fedorahosted.org/pipermail/sssd-devel/2013-March/014066.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb'}, {'name': '58593', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58593'}, {'name': '52722', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52722'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93'}, {'name': '1028317', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028317'}, {'name': 'RHSA-2013:0663', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0663.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0287?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0288 mean in the context of cybersecurity?

[Assistant] CVE-2013-0288


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0288.

[Assistant] nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0288?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288'}, {'name': 'RHSA-2013:0590', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0590.html'}, {'name': '58007', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58007'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319'}, {'name': 'DSA-2628', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2628'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81'}, {'name': '[oss-security] 20130218 CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/18/2'}, {'name': 'FEDORA-2013-2754', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html'}, {'name': '52212', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b'}, {'name': '52242', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52242'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32'}, {'name': 'MDVSA-2013:106', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:106'}, {'name': '[nss-pam-ldapd-announce] 20130218 nss-pam-ldapd security advisory (CVE-2013-0288)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html'}, {'name': 'nsspamldapd-fdsetsize-bo(82175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82175'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071'}, {'name': 'openSUSE-SU-2013:0522', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html'}, {'name': 'openSUSE-SU-2013:0524', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0288?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0289 mean in the context of cybersecurity?

[Assistant] CVE-2013-0289


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0289.

[Assistant] Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0289?

[Assistant] {'name': 'FEDORA-2013-2758', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html'}, {'name': '57423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57423'}, {'name': 'isync-ssl-info-disc(82232)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82232'}, {'name': '[oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification  (CVE-2013-0289)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/9'}, {'name': '55190', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55190'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/isync/files/isync/1.0.6/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb'}, {'name': 'GLSA-201310-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-02.xml'}, {'name': 'FEDORA-2013-2795', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0289?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0290 mean in the context of cybersecurity?

[Assistant] CVE-2013-0290


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0290.

[Assistant] The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0290?

[Assistant] {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=911473'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=77c1090f94d1b0b5186fb13a1b71b47b1343f87f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/77c1090f94d1b0b5186fb13a1b71b47b1343f87f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.8.bz2'}, {'name': '[oss-security] 20130214 Re: CVE Request: kernel -- local DOS (endless loop with interrupts disabled)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/2'}, {'name': 'openSUSE-SU-2013:1042', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00017.html'}, {'name': 'openSUSE-SU-2013:0951', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00009.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0290?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0291 mean in the context of cybersecurity?

[Assistant] CVE-2013-0291


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0291.

[Assistant] NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0291?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/57957'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/3'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0291?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0292 mean in the context of cybersecurity?

[Assistant] CVE-2013-0292


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0292.

[Assistant] The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0292?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': '33614', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/33614'}, {'name': 'MDVSA-2013:071', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:071'}, {'name': '52225', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52225'}, {'name': 'dbus-message-sender-priv-esc(82135)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82135'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658'}, {'name': '52375', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52375'}, {'name': 'USN-1753-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1753-1'}, {'name': 'RHSA-2013:0568', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0568.html'}, {'name': '57985', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57985'}, {'name': '52404', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52404'}, {'name': '[oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in  dbus-glib < 0.100.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': '90302', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90302'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=60916'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0292?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0293 mean in the context of cybersecurity?

[Assistant] CVE-2013-0293


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0293.

[Assistant] oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0293?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0293'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0293'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/13'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/58227'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82474'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0293?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0294 mean in the context of cybersecurity?

[Assistant] CVE-2013-0294


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0294.

[Assistant] packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0294?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=911682'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/57984'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82133'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0294?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0295 mean in the context of cybersecurity?

[Assistant] CVE-2013-0295


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0295.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0295?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0295?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0296 mean in the context of cybersecurity?

[Assistant] CVE-2013-0296


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0296.

[Assistant] Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0296?

[Assistant] {'name': 'openSUSE-SU-2013:0540', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html'}, {'name': '[pigz-announce] 20120728 pigz version 2.2.5 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html'}, {'name': '[oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure  permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/16/3'}, {'name': '[oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/15/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0296?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0297 mean in the context of cybersecurity?

[Assistant] CVE-2013-0297


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0297.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0297?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0297?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0298 mean in the context of cybersecurity?

[Assistant] CVE-2013-0298


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0298.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0298?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0298?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0299 mean in the context of cybersecurity?

[Assistant] CVE-2013-0299


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0299.

[Assistant] Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0299?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0299?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0300 mean in the context of cybersecurity?

[Assistant] CVE-2013-0300


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0300.

[Assistant] Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0300?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0300?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0301 mean in the context of cybersecurity?

[Assistant] CVE-2013-0301


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0301.

[Assistant] Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0301?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-004/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0301?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0302 mean in the context of cybersecurity?

[Assistant] CVE-2013-0302


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0302.

[Assistant] Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0302?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-005/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0302?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0303 mean in the context of cybersecurity?

[Assistant] CVE-2013-0303


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0303.

[Assistant] Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0303?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-006/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0303?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0304 mean in the context of cybersecurity?

[Assistant] CVE-2013-0304


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0304.

[Assistant] ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php.  NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0304?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-007/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0304?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0305 mean in the context of cybersecurity?

[Assistant] CVE-2013-0305


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0305.

[Assistant] The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0305?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2013/feb/19/security/'}, {'name': 'USN-1757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1757-1'}, {'name': 'DSA-2634', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2634'}, {'name': 'RHSA-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0670.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0305?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0306 mean in the context of cybersecurity?

[Assistant] CVE-2013-0306


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0306.

[Assistant] The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0306?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2013/feb/19/security/'}, {'name': 'USN-1757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1757-1'}, {'name': 'DSA-2634', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2634'}, {'name': 'RHSA-2013:0670', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0670.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0306?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0307 mean in the context of cybersecurity?

[Assistant] CVE-2013-0307


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0307.

[Assistant] Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0307?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://owncloud.org/about/security/advisories/oC-SA-2013-003/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0307?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0308 mean in the context of cybersecurity?

[Assistant] CVE-2013-0308


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0308.

[Assistant] The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0308?

[Assistant] {'name': '1028205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1028205'}, {'name': 'RHSA-2013:0589', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0589.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5937'}, {'name': 'git-gitimapsend-spoofing(82329)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82329'}, {'name': 'APPLE-SA-2013-09-18-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00007.html'}, {'name': '52361', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52361'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586'}, {'name': '[ANNOUNCE] 20130220 Git v1.8.1.4', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=git&m=136134619013145&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'openSUSE-SU-2013:0380', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00005.html'}, {'name': '58148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58148'}, {'name': '52443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52443'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=909977'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=804730'}, {'name': 'openSUSE-SU-2013:0382', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00007.html'}, {'name': '52467', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52467'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0308?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0309 mean in the context of cybersecurity?

[Assistant] CVE-2013-0309


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0309.

[Assistant] arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0309?

[Assistant] {'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=027ef6c87853b0a9df53175063028edb4950d476'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912898'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/027ef6c87853b0a9df53175063028edb4950d476'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/4'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0309?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0310 mean in the context of cybersecurity?

[Assistant] CVE-2013-0310


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0310.

[Assistant] The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0310?

[Assistant] {'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=89d7ae34cdda4195809a5a987f697a517a2a3177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/89d7ae34cdda4195809a5a987f697a517a2a3177'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/5'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0310?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0311 mean in the context of cybersecurity?

[Assistant] CVE-2013-0311


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0311.

[Assistant] The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0311?

[Assistant] {'name': 'RHSA-2013:0496', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0496.html'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/bd97120fc3d1a11f3124c7c9ba1d91f51829eb85'}, {'name': 'RHSA-2013:0882', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0882.html'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': '[oss-security] 20130219 Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/6'}, {'name': 'RHSA-2013:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0579.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912905'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0311?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0312 mean in the context of cybersecurity?

[Assistant] CVE-2013-0312


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0312.

[Assistant] 389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0312?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://directory.fedoraproject.org/wiki/Releases/1.3.0.4'}, {'name': '52568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52568'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912964'}, {'tags': ['x_refsource_MISC'], 'url': 'https://fedorahosted.org/389/ticket/571'}, {'name': '58428', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58428'}, {'name': 'RHSA-2013:0628', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0628.html'}, {'name': '52279', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52279'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0312?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0313 mean in the context of cybersecurity?

[Assistant] CVE-2013-0313


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0313.

[Assistant] The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0313?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/20/16'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913266'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/a67adb997419fb53540d4a4f79c6471c60bc69b6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a67adb997419fb53540d4a4f79c6471c60bc69b6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0313?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0314 mean in the context of cybersecurity?

[Assistant] CVE-2013-0314


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0314.

[Assistant] The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0314?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913327'}, {'name': '52552', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52552'}, {'name': '91120', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/91120'}, {'name': 'RHSA-2013:0613', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0613.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0314?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0315 mean in the context of cybersecurity?

[Assistant] CVE-2013-0315


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0315.

[Assistant] The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0315?

[Assistant] {'name': '91121', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/91121'}, {'name': '52552', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52552'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913340'}, {'name': 'RHSA-2013:0613', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0613.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0315?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0316 mean in the context of cybersecurity?

[Assistant] CVE-2013-0316


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0316.

[Assistant] The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0316?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/SA-CORE-2013-002'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0316?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0317 mean in the context of cybersecurity?

[Assistant] CVE-2013-0317


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0317.

[Assistant] Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0317?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1915408'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1916312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/og_manager_change.git/commitdiff/ab7152b'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0317?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0318 mean in the context of cybersecurity?

[Assistant] CVE-2013-0318


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0318.

[Assistant] The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0318?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1916370'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0318?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0319 mean in the context of cybersecurity?

[Assistant] CVE-2013-0319


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0319.

[Assistant] Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0319?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/yandex_metrics.git/commitdiff/80bb901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1921340'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1921342'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/yandex_metrics.git/commitdiff/290b718'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922400'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0319?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0320 mean in the context of cybersecurity?

[Assistant] CVE-2013-0320


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0320.

[Assistant] Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0320?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922170'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/taxonomy_manager.git/commitdiff/2d05801'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922410'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/taxonomy_manager.git/commitdiff/595f1b3'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0320?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0321 mean in the context of cybersecurity?

[Assistant] CVE-2013-0321


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0321.

[Assistant] Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0321?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/uc_views.git/commitdiff/157d5d3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922128'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922416'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0321?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0322 mean in the context of cybersecurity?

[Assistant] CVE-2013-0322


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0322.

[Assistant] Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0322?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ubercart.git/commitdiff/f9d69b5'}, {'name': '52298', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52298'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922136'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922418'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0322?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0323 mean in the context of cybersecurity?

[Assistant] CVE-2013-0323


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0323.

[Assistant] Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0323?

[Assistant] {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/45d490e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922430'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/90bcd8f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922424'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922438'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/ds.git/commitdiff/665c791'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0323?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0324 mean in the context of cybersecurity?

[Assistant] CVE-2013-0324


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0324.

[Assistant] Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0324?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922446'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922434'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0324?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0325 mean in the context of cybersecurity?

[Assistant] CVE-2013-0325


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0325.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0325?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1922756'}, {'name': '[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/varnish.git/commitdiff/f69a62c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/varnish.git/commitdiff/e6726b4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922726'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1922730'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0325?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0326 mean in the context of cybersecurity?

[Assistant] CVE-2013-0326


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0326.

[Assistant] OpenStack nova base images permissions are world readable


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0326?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-0326'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-0326'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0326?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0327 mean in the context of cybersecurity?

[Assistant] CVE-2013-0327


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0327.

[Assistant] Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0327?

[Assistant] {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914875'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0327?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0328 mean in the context of cybersecurity?

[Assistant] CVE-2013-0328


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0328.

[Assistant] Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0328?

[Assistant] {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914876'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0328?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0329 mean in the context of cybersecurity?

[Assistant] CVE-2013-0329


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0329.

[Assistant] Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0329?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914877'}, {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0329?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0330 mean in the context of cybersecurity?

[Assistant] CVE-2013-0330


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0330.

[Assistant] Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0330?

[Assistant] {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914878'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0330?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0331 mean in the context of cybersecurity?

[Assistant] CVE-2013-0331


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0331.

[Assistant] Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0331?

[Assistant] {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=914879'}, {'name': 'RHSA-2013:0638', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0638.html'}, {'name': '[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/7'}, {'name': '57994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0331?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0332 mean in the context of cybersecurity?

[Assistant] CVE-2013-0332


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0332.

[Assistant] Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0332?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zoneminder.com/wiki/index.php/Change_History'}, {'name': 'DSA-2640', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2640'}, {'name': '[oss-security] 20130220 Re: CVE request: zoneminder: local file inclusion vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700912'}, {'name': '[oss-security] 20130221 Re: CVE request: zoneminder: local file inclusion vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/9'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0332?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0333 mean in the context of cybersecurity?

[Assistant] CVE-2013-0333


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0333.

[Assistant] lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0333?

[Assistant] {'name': 'VU#628463', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/628463'}, {'name': 'DSA-2613', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2613'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5784'}, {'name': 'APPLE-SA-2013-06-04-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html'}, {'name': 'APPLE-SA-2013-03-14-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html'}, {'name': '[rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain'}, {'name': 'RHSA-2013:0201', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0201.html'}, {'name': 'RHSA-2013:0202', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0202.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/cve-2013-0333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/'}, {'name': 'RHSA-2013:0203', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0203.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0333?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0334 mean in the context of cybersecurity?

[Assistant] CVE-2013-0334


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0334.

[Assistant] Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0334?

[Assistant] {'name': 'GLSA-201609-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201609-02'}, {'name': 'FEDORA-2014-11649', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.html'}, {'name': 'FEDORA-2014-11630', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'FEDORA-2014-11677', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.html'}, {'name': 'openSUSE-SU-2015:0628', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.html'}, {'name': '70099', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70099'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0334?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0335 mean in the context of cybersecurity?

[Assistant] CVE-2013-0335


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0335.

[Assistant] OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0335?

[Assistant] {'name': '90657', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90657'}, {'name': '52728', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52728'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/nova/+bug/1125378'}, {'name': '[oss-security] 20130226 [OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22872/'}, {'name': 'USN-1771-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1771-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22758'}, {'name': 'RHSA-2013:0709', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0709.html'}, {'name': '52337', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52337'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/22086/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0335?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0336 mean in the context of cybersecurity?

[Assistant] CVE-2013-0336


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0336.

[Assistant] The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0336?

[Assistant] {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=913751'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=7b45e33400355df44e75576ef7f70a39d163bf8e'}, {'name': '58747', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/freeipa/ticket/3539'}, {'name': '52763', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52763'}, {'name': '389directoryserver-cve20130336-dos(83132)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/83132'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0336?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0337 mean in the context of cybersecurity?

[Assistant] CVE-2013-0337


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0337.

[Assistant] The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0337?

[Assistant] {'name': '55181', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55181'}, {'name': '[oss-security] 20130224 nginx CVE-2013-0337 world-readable logs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/24/1'}, {'name': '[oss-security] 20130221 Re: CVE request: nginx world-readable logdir', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/22/1'}, {'name': 'GLSA-201310-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-04.xml'}, {'name': '[oss-security] 20130221 nginx world-readable logdir', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/15'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0337?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0338 mean in the context of cybersecurity?

[Assistant] CVE-2013-0338


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0338.

[Assistant] libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0338?

[Assistant] {'name': '52662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52662'}, {'name': 'openSUSE-SU-2013:0555', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html'}, {'name': 'SUSE-SU-2013:1627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=912400'}, {'name': 'openSUSE-SU-2013:0552', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html'}, {'name': 'SSRT101996', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=142798889927587&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html'}, {'name': 'DSA-2652', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2652'}, {'name': 'HPSBGN03302', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=142798889927587&w=2'}, {'name': '55568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55568'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab'}, {'name': 'USN-1782-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1782-1'}, {'name': 'MDVSA-2013:056', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:056'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0338?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0339 mean in the context of cybersecurity?

[Assistant] CVE-2013-0339


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0339.

[Assistant] libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0339?

[Assistant] {'name': '52662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52662'}, {'name': 'SUSE-SU-2013:1627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html'}, {'name': '[oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/21/24'}, {'name': '[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/22/3'}, {'name': '[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/188'}, {'name': '[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/184'}, {'name': '[oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2013/q4/182'}, {'name': 'USN-1904-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1904-2'}, {'name': 'USN-1904-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1904-1'}, {'name': 'DSA-2652', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2652'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=915149'}, {'name': '54172', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54172'}, {'name': '55568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55568'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f'}, {'name': '[oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/12/6'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0339?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0340 mean in the context of cybersecurity?

[Assistant] CVE-2013-0340


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2013-0340.

[Assistant] expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2013-0340?

[Assistant] {'name': '[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2013/02/22/3'}, {'name': '[oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/04/12/6'}, {'name': '90634', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/90634'}, {'name': '1028213', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028213'}, {'name': 'GLSA-201701-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-21'}, {'name': '58233', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58233'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212805'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212804'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212807'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212819'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212815'}, {'name': '20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/33'}, {'name': '20210921 APPLE-SA-2021-09-20-2 watchOS 8', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/34'}, {'name': '20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/40'}, {'name': '20210921 APPLE-SA-2021-09-20-3 tvOS 15', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/35'}, {'name': '20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/38'}, {'name': '20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/39'}, {'name': '[announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E'}, {'name': '[openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E'}, {'name': '[oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2021/10/07/4'}, {'name': '20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Oct/62'}, {'name': '20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Oct/63'}, {'name': '20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Oct/61'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2013-0340?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2013-0341 mean in the context of cybersecurity?

[Assistant] CVE-2013-0341