2013 CVEs (page 5)
Page 5 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-0342 | Medium | 4.3 | 2019-12-09 | The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting th… |
CVE-2013-0326 | Medium | 5.5 | 2019-12-05 | OpenStack nova base images permissions are world readable |
CVE-2013-0283 | Medium | 5.4 | 2019-12-05 | Katello: Username in Notification page has cross site scripting |
CVE-2013-0243 | High | 7.4 | 2019-12-05 | haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections |
CVE-2013-0163 | Medium | 5.5 | 2019-12-05 | OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS |
CVE-2013-2745 | Critical | 9.8 | 2019-12-04 | An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0 |
CVE-2013-7325 | High | 8.8 | 2019-12-03 | An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. |
CVE-2013-4486 | Critical | 9.8 | 2019-12-03 | Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging |
CVE-2013-4411 | Medium | 4.3 | 2019-12-03 | Review Board: URL processing gives unauthorized users access to review lists |
CVE-2013-4235 | Medium | 4.7 | 2019-12-03 | shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees |
CVE-2013-2228 | High | 8.1 | 2019-12-03 | SaltStack RSA Key Generation allows remote users to decrypt communications |
CVE-2013-2106 | High | 7.5 | 2019-12-03 | webauth before 4.6.1 has authentication credential disclosure |
CVE-2013-2103 | High | 8.1 | 2019-12-03 | OpenShift cartridge allows remote URL retrieval |
CVE-2013-2101 | Medium | 5.4 | 2019-12-03 | Katello has multiple XSS issues in various entities |
CVE-2013-4410 | High | 7.5 | 2019-12-02 | ReviewBoard: has an access-control problem in REST API |
CVE-2013-7484 | High | 7.5 | 2019-11-30 | Zabbix before 5.0 represents passwords in the users table with unsalted MD5. |
CVE-2013-2625 | Medium | 6.5 | 2019-11-27 | An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2… |
CVE-2013-6879 | Medium | 5.3 | 2019-11-22 | The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/s… |
CVE-2013-6878 | Medium | 6.1 | 2019-11-22 | Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web scr… |
CVE-2013-6239 | Medium | 6.1 | 2019-11-22 | Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2013-6234 | High | 8.0 | 2019-11-22 | Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading… |
CVE-2013-0203 | Medium | 5.4 | 2019-11-22 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via th… |
CVE-2013-6880 | Medium | 6.1 | 2019-11-22 | Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) at… |
CVE-2013-6811 | High | 8.8 | 2019-11-22 | Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of adm… |
CVE-2013-3314 | High | 7.5 | 2019-11-21 | The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), tim… |
CVE-2013-3313 | High | 7.5 | 2019-11-21 | The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_us… |
CVE-2013-3312 | High | 8.8 | 2019-11-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified… |
CVE-2013-3311 | High | 7.5 | 2019-11-21 | Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (dot dot) in the URL of an HTTP GE… |
CVE-2013-7172 | High | 7.8 | 2019-11-21 | Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package, which could allow… |
CVE-2013-7171 | Critical | 9.8 | 2019-11-21 | Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which could allow remote attack… |
CVE-2013-2093 | Critical | 9.8 | 2019-11-20 | Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands. |
CVE-2013-2092 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. |
CVE-2013-2091 | Critical | 9.8 | 2019-11-20 | SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php. |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2013-0195 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2013-0194 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2013-0193 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2013-7089 | High | 7.5 | 2019-11-15 | ClamAV before 0.97.7: dbg_printhex possible information leak |
CVE-2013-7088 | Critical | 9.8 | 2019-11-15 | ClamAV before 0.97.7 has buffer overflow in the libclamav component |
CVE-2013-7087 | Critical | 9.8 | 2019-11-15 | ClamAV before 0.97.7 has WWPack corrupt heap memory |
CVE-2013-4584 | Medium | 5.9 | 2019-11-15 | Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers no… |
CVE-2013-4108 | Critical | 9.8 | 2019-11-14 | Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors. |
CVE-2013-4106 | Medium | 6.1 | 2019-11-14 | A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22. |
CVE-2013-4109 | Medium | 6.1 | 2019-11-14 | An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165. |
CVE-2013-3072 | Critical | 9.8 | 2019-11-14 | An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visite… |
CVE-2013-3070 | High | 7.5 | 2019-11-14 | An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wi… |
CVE-2013-3073 | Critical | 9.8 | 2019-11-14 | A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34. |
CVE-2013-3366 | High | 8.8 | 2019-11-13 | Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3. |
CVE-2013-3097 | Medium | 6.1 | 2019-11-13 | Unspecified Cross-site scripting (XSS) vulnerability in the Verizon FIOS Actiontec MI424WR-GEN3I router. |
CVE-2013-4275 | Medium | 5.4 | 2019-11-13 | Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, and 7.x-5.x before 7… |
CVE-2013-3367 | Critical | 9.8 | 2019-11-13 | Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_… |
CVE-2013-3516 | Medium | 6.5 | 2019-11-13 | NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens. |
CVE-2013-3517 | Medium | 5.4 | 2019-11-13 | Cross-site scripting (XSS) vulnerability in NETGEAR WNR3500U and WNR3500L. |
CVE-2013-4657 | Critical | 9.8 | 2019-11-13 | Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service. |
CVE-2013-4655 | High | 7.5 | 2019-11-13 | Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service. |
CVE-2013-4654 | Critical | 9.8 | 2019-11-13 | Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND.. |
CVE-2013-4656 | Critical | 9.8 | 2019-11-13 | Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service. |
CVE-2013-1889 | High | 7.5 | 2019-11-08 | mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out of the chroot. |
CVE-2013-1820 | Medium | 5.5 | 2019-11-08 | tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. |
CVE-2013-1811 | Medium | 4.3 | 2019-11-07 | An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". |
CVE-2013-1809 | High | 7.5 | 2019-11-07 | Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary direc… |
CVE-2013-1771 | High | 7.5 | 2019-11-07 | The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo. |
CVE-2013-1751 | Critical | 9.8 | 2019-11-07 | TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick cha… |
CVE-2013-1429 | Medium | 6.3 | 2019-11-07 | Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. |
CVE-2013-1426 | Medium | 6.1 | 2019-11-07 | Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor. |
CVE-2013-1425 | Medium | 5.5 | 2019-11-07 | ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions. |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2013-6275 | Medium | 6.5 | 2019-11-05 | Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. |
CVE-2013-5661 | Medium | 5.9 | 2019-11-05 | Cache Poisoning issue exists in DNS Response Rate Limiting. |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2013-6365 | Medium | 5.3 | 2019-11-05 | Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions |
CVE-2013-6364 | High | 8.8 | 2019-11-05 | Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book |
CVE-2013-4110 | Medium | 5.3 | 2019-11-05 | Cryptocat has an Unspecified Chat Participant User List Disclosure |
CVE-2013-4107 | Medium | 6.1 | 2019-11-05 | Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting |
CVE-2013-4374 | High | 7.1 | 2019-11-04 | An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files. |
CVE-2013-4409 | Critical | 9.8 | 2019-11-04 | An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. |
CVE-2013-4251 | High | 7.8 | 2019-11-04 | The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
CVE-2013-4280 | Medium | 5.5 | 2019-11-04 | Insecure temporary file vulnerability in RedHat vsdm 4.9.6. |
CVE-2013-4105 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure |
CVE-2013-2260 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness |
CVE-2013-2259 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview |
CVE-2013-2258 | Medium | 5.3 | 2019-11-04 | Cryptocat before 2.0.22 has Nickname User Impersonation |
CVE-2013-2257 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness |
CVE-2013-4104 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol |
CVE-2013-2262 | High | 7.5 | 2019-11-04 | Cryptocat strophe.js before 2.0.22 has information disclosure |
CVE-2013-2261 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure |
CVE-2013-4103 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input |
CVE-2013-4102 | Critical | 9.1 | 2019-11-04 | Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness |
CVE-2013-4101 | Medium | 5.3 | 2019-11-04 | Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness |
CVE-2013-4100 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 has Remote Denial of Service via username |
CVE-2013-4518 | Medium | 5.5 | 2019-11-04 | RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates |
CVE-2013-4423 | Medium | 5.5 | 2019-11-04 | CloudForms stores user passwords in recoverable format |
CVE-2013-4412 | High | 7.5 | 2019-11-04 | slim has NULL pointer dereference when using crypt() method from glibc 2.17 |
CVE-2013-4168 | Medium | 6.1 | 2019-11-01 | Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields. |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2013-0186 | Medium | 6.1 | 2019-11-01 | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2013-0180 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds. |
CVE-2013-0178 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm. |