2013 CVEs (page 2)
Page 2 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-7487 | Critical | 9.8 | 2020-03-21 | On Swann DVR04B, DVR08B, DVR-16CIF, and DVR16B devices, raysharpdvr application has a vulnerable call to “system”, which allows remote attackers to execute arb… |
CVE-2013-1753 | High | 7.5 | 2020-03-11 | The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a… |
CVE-2013-3587 | Medium | 5.9 | 2020-02-21 | The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which… |
CVE-2013-4088 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly re… |
CVE-2013-3551 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x b… |
CVE-2013-2018 | Critical | 9.8 | 2020-02-20 | Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2013-4228 | Medium | 4.3 | 2020-02-18 | The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to pr… |
CVE-2013-4226 | Medium | 6.5 | 2020-02-18 | The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote… |
CVE-2013-6295 | Critical | 9.8 | 2020-02-18 | PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module |
CVE-2013-3323 | Critical | 9.8 | 2020-02-18 | A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure… |
CVE-2013-2679 | Medium | 6.1 | 2020-02-18 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web s… |
CVE-2013-4227 | High | 8.8 | 2020-02-18 | Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for… |
CVE-2013-4454 | Critical | 9.1 | 2020-02-18 | WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities |
CVE-2013-5594 | Medium | 4.3 | 2020-02-18 | Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding |
CVE-2013-7324 | Medium | 5.3 | 2020-02-17 | Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound volume via malicious… |
CVE-2013-3722 | High | 7.5 | 2020-02-17 | A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c. |
CVE-2013-3738 | Critical | 9.8 | 2020-02-17 | A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user… |
CVE-2013-4211 | Critical | 9.8 | 2020-02-14 | A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user e… |
CVE-2013-5687 | High | 7.5 | 2020-02-14 | RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure. |
CVE-2013-5212 | Medium | 6.1 | 2020-02-14 | Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file. |
CVE-2013-4792 | Medium | 5.5 | 2020-02-14 | PrestaShop before 1.4.11 allows logout CSRF. |
CVE-2013-4791 | Medium | 5.4 | 2020-02-14 | PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. |
CVE-2013-7287 | Critical | 9.8 | 2020-02-13 | MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. |
CVE-2013-7173 | Critical | 9.8 | 2020-02-13 | Belkin n750 routers have a buffer overflow. |
CVE-2013-7098 | Critical | 9.8 | 2020-02-13 | OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection. |
CVE-2013-6927 | Medium | 5.5 | 2020-02-13 | Internet TRiLOGI Server (unknown versions) could allow a local user to bypass security and create a local user account. |
CVE-2013-6362 | Critical | 9.8 | 2020-02-13 | Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts. |
CVE-2013-6360 | High | 7.5 | 2020-02-13 | TRENDnet TS-S402 has a backdoor to enable TELNET. |
CVE-2013-6277 | High | 7.5 | 2020-02-13 | QNAP VioCard 300 has hardcoded RSA private keys. |
CVE-2013-1634 | High | 7.5 | 2020-02-13 | A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the dev… |
CVE-2013-1401 | Critical | 9.8 | 2020-02-13 | Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow… |
CVE-2013-1400 | Critical | 9.8 | 2020-02-13 | Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the poll… |
CVE-2013-6022 | Medium | 6.1 | 2020-02-12 | A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user exe… |
CVE-2013-5106 | High | 8.8 | 2020-02-12 | A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. |
CVE-2013-4602 | Medium | 5.5 | 2020-02-12 | A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine. |
CVE-2013-3725 | Critical | 9.8 | 2020-02-12 | Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. |
CVE-2013-7286 | High | 7.5 | 2020-02-12 | MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm |
CVE-2013-2637 | Medium | 6.1 | 2020-02-12 | A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items… |
CVE-2013-6681 | Medium | 5.9 | 2020-02-12 | Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability |
CVE-2013-6236 | Critical | 9.8 | 2020-02-12 | IZON IP 2.0.2: hard-coded password vulnerability |
CVE-2013-4395 | Medium | 6.1 | 2020-02-12 | Simple Machines Forum (SMF) through 2.0.5 has XSS |
CVE-2013-4090 | High | 7.5 | 2020-02-12 | Varnish HTTP cache before 3.0.4: ACL bug |
CVE-2013-3685 | High | 7.0 | 2020-02-12 | A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a… |
CVE-2013-3494 | High | 7.8 | 2020-02-12 | A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries. which could let a… |
CVE-2013-2097 | High | 7.8 | 2020-02-12 | ZPanel through 10.1.0 has Remote Command Execution |
CVE-2013-1938 | Medium | 6.1 | 2020-02-12 | Zimbra 2013 has XSS in aspell.php |
CVE-2013-1924 | High | 7.5 | 2020-02-12 | Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2 |
CVE-2013-7381 | Critical | 9.8 | 2020-02-12 | libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify. |
CVE-2013-2010 | Critical | 9.8 | 2020-02-12 | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability |
CVE-2013-1410 | Medium | 6.1 | 2020-02-12 | Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities |
CVE-2013-7378 | Critical | 9.8 | 2020-02-12 | scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands. |
CVE-2013-4225 | High | 8.8 | 2020-02-11 | The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operati… |
CVE-2013-2213 | Medium | 5.5 | 2020-02-11 | The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which m… |
CVE-2013-2120 | High | 8.4 | 2020-02-11 | The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allo… |
CVE-2013-5582 | High | 7.8 | 2020-02-11 | Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentica… |
CVE-2013-5988 | Medium | 6.1 | 2020-02-11 | A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. |
CVE-2013-3942 | High | 7.8 | 2020-02-11 | Potplayer prior to 1.5.39659: DLL Loading Arbitrary Code Execution Vulnerability |
CVE-2013-3684 | Critical | 9.8 | 2020-02-11 | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload |
CVE-2013-2057 | Critical | 9.8 | 2020-02-11 | YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability |
CVE-2013-1760 | Medium | 6.1 | 2020-02-11 | The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities |
CVE-2013-1607 | Critical | 9.8 | 2020-02-11 | Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability |
CVE-2013-0517 | High | 7.8 | 2020-02-11 | A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which co… |
CVE-2013-1359 | Critical | 9.8 | 2020-02-11 | An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management… |
CVE-2013-0803 | Critical | 9.8 | 2020-02-11 | A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code. |
CVE-2013-4535 | High | 8.8 | 2020-02-11 | The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related… |
CVE-2013-1360 | Critical | 9.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management… |
CVE-2013-5945 | Critical | 9.8 | 2020-02-11 | Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmwar… |
CVE-2013-4267 | Critical | 9.8 | 2020-02-11 | Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS modul… |
CVE-2013-2109 | High | 8.8 | 2020-02-10 | WordPress plugin wp-cleanfix has Remote Code Execution |
CVE-2013-2108 | Medium | 5.4 | 2020-02-10 | WordPress WP Cleanfix Plugin 2.4.4 has CSRF |
CVE-2013-1353 | Medium | 5.4 | 2020-02-10 | Orange HRM 2.7.1 allows XSS via the vacancy name. |
CVE-2013-3096 | Medium | 5.9 | 2020-02-07 | D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability. |
CVE-2013-3091 | Critical | 9.8 | 2020-02-07 | An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." |
CVE-2013-3067 | Medium | 5.4 | 2020-02-07 | Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS. |
CVE-2013-4335 | Critical | 9.8 | 2020-02-07 | opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities |
CVE-2013-3637 | Medium | 5.4 | 2020-02-07 | ProjectPier 0.8.8 does not use the Secure flag for cookies |
CVE-2013-3636 | Medium | 5.4 | 2020-02-07 | ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag |
CVE-2013-3635 | Medium | 5.4 | 2020-02-07 | ProjectPier 0.8.8 has stored XSS |
CVE-2013-3629 | High | 8.8 | 2020-02-07 | ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution |
CVE-2013-3628 | High | 8.8 | 2020-02-07 | Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability |
CVE-2013-3591 | High | 8.8 | 2020-02-07 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability |
CVE-2013-4334 | Critical | 9.8 | 2020-02-07 | opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities |
CVE-2013-2009 | High | 8.8 | 2020-02-07 | WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution |
CVE-2013-2008 | Medium | 6.1 | 2020-02-07 | WordPress Super Cache Plugin 1.3 has XSS. |
CVE-2013-1202 | High | 7.5 | 2020-02-07 | Cisco ACE A2(3.6) allows log retention DoS. |
CVE-2013-0192 | Medium | 4.9 | 2020-02-07 | File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config. |
CVE-2013-3638 | High | 8.8 | 2020-02-06 | SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'c… |
CVE-2013-3568 | High | 8.8 | 2020-02-06 | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have un… |
CVE-2013-3564 | Medium | 5.3 | 2020-02-06 | The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' comman… |
CVE-2013-2684 | Medium | 6.1 | 2020-02-06 | Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2013-2683 | Medium | 5.3 | 2020-02-06 | Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and oth… |
CVE-2013-4521 | Critical | 9.8 | 2020-02-06 | RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be call… |
CVE-2013-4572 | High | 7.5 | 2020-02-06 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies… |
CVE-2013-4166 | High | 7.5 | 2020-02-06 | The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not prope… |
CVE-2013-2682 | Medium | 4.3 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information. |
CVE-2013-2681 | Critical | 9.8 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. |
CVE-2013-2680 | High | 7.5 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. |
CVE-2013-2675 | Medium | 6.5 | 2020-02-05 | Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensiti… |
CVE-2013-0507 | High | 8.1 | 2020-02-05 | IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability |
CVE-2013-2678 | High | 8.1 | 2020-02-04 | Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or exe… |