2013 CVEs (page 3)
Page 3 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-2676 | High | 7.5 | 2020-02-04 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and othe… |
CVE-2013-7055 | Critical | 9.8 | 2020-02-04 | D-Link DIR-100 4.03B07 has PPTP and poe information disclosure |
CVE-2013-7054 | Medium | 6.1 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi XSS |
CVE-2013-7053 | High | 8.8 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi CSRF |
CVE-2013-7052 | Critical | 9.8 | 2020-02-04 | D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script |
CVE-2013-7051 | High | 8.8 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters |
CVE-2013-1422 | Medium | 5.3 | 2020-02-04 | webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user"). |
CVE-2013-2674 | High | 7.5 | 2020-02-03 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from re… |
CVE-2013-2673 | Medium | 6.8 | 2020-02-03 | Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access. |
CVE-2013-2672 | High | 7.5 | 2020-02-03 | Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords. |
CVE-2013-2646 | High | 7.5 | 2020-02-03 | TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability. |
CVE-2013-2631 | Medium | 5.3 | 2020-02-03 | TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the… |
CVE-2013-2624 | Medium | 5.3 | 2020-02-03 | Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafte… |
CVE-2013-2623 | Medium | 6.1 | 2020-02-03 | Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php. |
CVE-2013-2622 | Medium | 6.1 | 2020-02-03 | Cross-site Scripting (XSS) in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selected_theme" parameter in… |
CVE-2013-2621 | Medium | 6.1 | 2020-02-03 | Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted U… |
CVE-2013-3565 | Medium | 6.1 | 2020-01-31 | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary… |
CVE-2013-3489 | High | 7.8 | 2020-01-31 | Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a crafted RealMedia .rm file |
CVE-2013-3488 | High | 7.8 | 2020-01-31 | Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to execute arbitrary code via a crafted MP… |
CVE-2013-5116 | High | 7.1 | 2020-01-31 | Evernote prior to 5.5.1 has insecure password change |
CVE-2013-5114 | Medium | 6.1 | 2020-01-31 | LastPass prior to 2.5.1 allows secure wipe bypass. |
CVE-2013-5113 | Medium | 6.8 | 2020-01-31 | LastPass prior to 2.5.1 has an insecure PIN implementation. |
CVE-2013-5112 | Medium | 4.6 | 2020-01-31 | Evernote before 5.5.1 has insecure PIN storage |
CVE-2013-3322 | High | 7.2 | 2020-01-31 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface. |
CVE-2013-4241 | Medium | 6.1 | 2020-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web s… |
CVE-2013-4187 | Medium | 6.5 | 2020-01-30 | The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to… |
CVE-2013-2294 | Medium | 6.1 | 2020-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag… |
CVE-2013-2198 | Critical | 9.8 | 2020-01-30 | The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username. |
CVE-2013-1867 | Medium | 6.1 | 2020-01-30 | Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability |
CVE-2013-1866 | Medium | 6.1 | 2020-01-30 | OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability |
CVE-2013-1631 | Medium | 5.3 | 2020-01-30 | Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action |
CVE-2013-1352 | High | 7.5 | 2020-01-30 | Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive. |
CVE-2013-1351 | Medium | 5.9 | 2020-01-30 | Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password. |
CVE-2013-1350 | Critical | 9.1 | 2020-01-30 | Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities |
CVE-2013-0739 | Medium | 6.1 | 2020-01-30 | Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. |
CVE-2013-0738 | Medium | 6.1 | 2020-01-30 | Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. |
CVE-2013-0725 | High | 7.8 | 2020-01-30 | ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities |
CVE-2013-0291 | High | 7.5 | 2020-01-30 | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability |
CVE-2013-3321 | High | 7.5 | 2020-01-29 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page… |
CVE-2013-3320 | Medium | 6.1 | 2020-01-29 | Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the '… |
CVE-2013-3317 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. |
CVE-2013-3316 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg". |
CVE-2013-2574 | High | 7.5 | 2020-01-29 | An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malic… |
CVE-2013-2573 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. an… |
CVE-2013-2572 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials fo… |
CVE-2013-3215 | Critical | 9.8 | 2020-01-29 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
CVE-2013-2570 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt… |
CVE-2013-2569 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a mal… |
CVE-2013-2568 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote mali… |
CVE-2013-2567 | High | 7.5 | 2020-01-29 | An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which… |
CVE-2013-0161 | Medium | 5.4 | 2020-01-29 | Havalite CMS 1.1.7 has a stored XSS vulnerability |
CVE-2013-1603 | Medium | 5.3 | 2020-01-28 | An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1… |
CVE-2013-1602 | High | 7.5 | 2020-01-28 | An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L… |
CVE-2013-3214 | Critical | 9.8 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. |
CVE-2013-3212 | High | 8.1 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local s… |
CVE-2013-3093 | High | 8.8 | 2020-01-28 | ASUS RT-N56U devices allow CSRF. |
CVE-2013-3074 | High | 7.5 | 2020-01-28 | NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash). |
CVE-2013-3071 | Critical | 9.8 | 2020-01-28 | NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass. |
CVE-2013-1601 | Medium | 5.3 | 2020-01-28 | An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Info… |
CVE-2013-1600 | Medium | 5.3 | 2020-01-28 | An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS… |
CVE-2013-2764 | Medium | 6.1 | 2020-01-28 | Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due to HSP_AbsoluteRed… |
CVE-2013-2748 | Critical | 9.8 | 2020-01-28 | Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system. |
CVE-2013-2714 | Medium | 6.1 | 2020-01-28 | Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parame… |
CVE-2013-1599 | Critical | 9.8 | 2020-01-28 | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100… |
CVE-2013-4865 | Medium | 6.5 | 2020-01-28 | Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authent… |
CVE-2013-4864 | Critical | 9.8 | 2020-01-28 | MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, rel… |
CVE-2013-4863 | High | 8.8 | 2020-01-28 | The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action i… |
CVE-2013-4862 | High | 8.1 | 2020-01-28 | MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squash… |
CVE-2013-4861 | Medium | 6.5 | 2020-01-28 | Directory traversal vulnerability in cgi-bin/cmh/get_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary f… |
CVE-2013-4583 | High | 8.8 | 2020-01-28 | The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell… |
CVE-2013-4582 | Medium | 6.5 | 2020-01-28 | The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Editi… |
CVE-2013-2060 | Critical | 9.8 | 2020-01-28 | The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to do… |
CVE-2013-0294 | Medium | 5.9 | 2020-01-28 | packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obta… |
CVE-2013-6455 | Medium | 5.3 | 2020-01-28 | The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors re… |
CVE-2013-6451 | Medium | 6.1 | 2020-01-28 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arb… |
CVE-2013-2571 | Critical | 9.8 | 2020-01-28 | Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a crafted request to TCP p… |
CVE-2013-1895 | High | 7.5 | 2020-01-28 | The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple auth… |
CVE-2013-1437 | Critical | 9.8 | 2020-01-28 | Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version val… |
CVE-2013-2612 | Critical | 9.8 | 2020-01-27 | Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with root privileges due… |
CVE-2013-2499 | High | 7.5 | 2020-01-27 | SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie. |
CVE-2013-2474 | High | 7.5 | 2020-01-27 | Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter. |
CVE-2013-2267 | High | 7.2 | 2020-01-27 | PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system. |
CVE-2013-7390 | Critical | 9.8 | 2020-01-27 | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to exec… |
CVE-2013-4770 | Medium | 6.1 | 2020-01-27 | Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HT… |
CVE-2013-4441 | Critical | 9.8 | 2020-01-27 | The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force… |
CVE-2013-6056 | High | 7.5 | 2020-01-27 | OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability |
CVE-2013-5659 | High | 7.5 | 2020-01-27 | Wiz 5.0.3 has a user mode write access violation |
CVE-2013-4462 | Critical | 9.1 | 2020-01-27 | WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability |
CVE-2013-3493 | Critical | 9.8 | 2020-01-27 | XnView 2.03 has an integer overflow vulnerability |
CVE-2013-3492 | Critical | 9.8 | 2020-01-27 | XnView 2.03 has a stack-based buffer overflow vulnerability |
CVE-2013-3486 | Critical | 9.6 | 2020-01-27 | IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow Vulnerability |
CVE-2013-0286 | Medium | 5.4 | 2020-01-27 | Pinboard 1.0.6 theme for Wordpress has XSS. |
CVE-2013-1744 | Critical | 9.8 | 2020-01-25 | IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands. |
CVE-2013-1598 | High | 8.8 | 2020-01-24 | A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold l… |
CVE-2013-1597 | Medium | 6.5 | 2020-01-24 | A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user o… |
CVE-2013-1596 | Medium | 5.3 | 2020-01-24 | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. |
CVE-2013-1595 | Critical | 9.8 | 2020-01-24 | A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the… |
CVE-2013-1594 | High | 7.5 | 2020-01-24 | An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials sto… |
CVE-2013-4333 | Critical | 9.1 | 2020-01-24 | OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability |
CVE-2013-3960 | Critical | 9.9 | 2020-01-24 | Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass |