2013 CVEs (page 6)
Page 6 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-0165 | High | 7.3 | 2019-11-01 | cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. |
CVE-2013-4367 | High | 7.8 | 2019-11-01 | ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.ch… |
CVE-2013-2227 | High | 7.5 | 2019-11-01 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php. |
CVE-2013-1666 | Critical | 9.8 | 2019-11-01 | Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro. |
CVE-2013-4751 | High | 8.1 | 2019-11-01 | php-symfony2-Validator has loss of information during serialization |
CVE-2013-3718 | Medium | 5.5 | 2019-11-01 | evince is missing a check on number of pages which can lead to a segmentation fault |
CVE-2013-2739 | Critical | 9.8 | 2019-11-01 | MiniDLNA has heap-based buffer overflow |
CVE-2013-2738 | Critical | 9.8 | 2019-11-01 | minidlna has SQL Injection that may allow retrieval of arbitrary files |
CVE-2013-2600 | High | 7.5 | 2019-11-01 | MiniUPnPd has information disclosure use of snprintf() |
CVE-2013-2075 | High | 8.8 | 2019-10-31 | Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause… |
CVE-2013-2024 | High | 8.8 | 2019-10-31 | OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. |
CVE-2013-2012 | High | 7.3 | 2019-10-31 | autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory. |
CVE-2013-1951 | Medium | 6.1 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HT… |
CVE-2013-1945 | Low | 3.3 | 2019-10-31 | ruby193 uses an insecure LD_LIBRARY_PATH setting. |
CVE-2013-1934 | Medium | 5.4 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authentica… |
CVE-2013-1932 | Medium | 5.4 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inj… |
CVE-2013-1931 | Medium | 6.1 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting… |
CVE-2013-1930 | Medium | 4.3 | 2019-10-31 | MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. |
CVE-2013-1910 | Critical | 9.8 | 2019-10-31 | yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse… |
CVE-2013-1391 | High | 7.5 | 2019-10-30 | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remot… |
CVE-2013-4848 | High | 8.8 | 2019-10-25 | TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities. |
CVE-2013-4658 | Critical | 9.8 | 2019-10-25 | Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. |
CVE-2013-4857 | Critical | 9.8 | 2019-10-25 | D-Link DIR-865L has PHP File Inclusion in the router xml file. |
CVE-2013-4856 | Medium | 6.5 | 2019-10-25 | D-Link DIR-865L has Information Disclosure. |
CVE-2013-4855 | High | 8.8 | 2019-10-25 | D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba sh… |
CVE-2013-7333 | High | 7.5 | 2019-10-23 | A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selective… |
CVE-2013-7483 | Critical | 9.8 | 2019-08-22 | The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. |
CVE-2013-7482 | Medium | 6.1 | 2019-08-22 | The reflex-gallery plugin before 1.4.3 for WordPress has XSS. |
CVE-2013-7481 | Medium | 6.1 | 2019-08-22 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. |
CVE-2013-7480 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. |
CVE-2013-7479 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. |
CVE-2013-7478 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. |
CVE-2013-7477 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. |
CVE-2013-7476 | High | 8.8 | 2019-08-14 | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. |
CVE-2013-7475 | Medium | 6.1 | 2019-08-13 | The contact-form-plugin plugin before 3.52 for WordPress has XSS. |
CVE-2013-7474 | Medium | 6.1 | 2019-08-01 | Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. |
CVE-2013-7473 | High | 8.8 | 2019-08-01 | Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. |
CVE-2013-7472 | Medium | 6.1 | 2019-06-15 | The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter. |
CVE-2013-7471 | Critical | 9.8 | 2019-06-11 | An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and… |
CVE-2013-7285 | Critical | 9.8 | 2019-05-15 | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell com… |
CVE-2013-7470 | Medium | 5.9 | 2019-04-23 | cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of servic… |
CVE-2013-2805 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2013-2807 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2013-2806 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2013-7468 | High | 8.1 | 2019-03-07 | Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter. |
CVE-2013-7467 | Medium | 6.1 | 2019-03-07 | Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter. |
CVE-2013-7466 | High | 8.8 | 2019-03-07 | Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the db_type… |
CVE-2013-7469 | High | 7.5 | 2019-02-21 | Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to condu… |
CVE-2013-5654 | Critical | 9.1 | 2019-02-15 | Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage |
CVE-2013-2565 | Medium | 5.3 | 2019-02-15 | A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver. |
CVE-2013-2516 | High | 8.8 | 2019-02-15 | Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell. |
CVE-2013-7465 | Critical | 9.8 | 2018-10-05 | Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute arbitrary code by up… |
CVE-2013-7203 | Medium | 5.5 | 2018-09-21 | gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setu… |
CVE-2013-4451 | Critical | 9.8 | 2018-09-21 | gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gi… |
CVE-2013-7464 | High | 8.8 | 2018-08-08 | In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the… |
CVE-2013-0522 | High | 7.0 | 2018-07-16 | The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via… |
CVE-2013-0570 | Medium | 5.3 | 2018-07-13 | The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (ak… |
CVE-2013-2972 | High | 7.5 | 2018-07-11 | IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors. IBM X-Force ID: 83868. |
CVE-2013-2951 | High | 7.8 | 2018-07-11 | IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Management), which allows lo… |
CVE-2013-0594 | Medium | 6.1 | 2018-07-11 | Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and con… |
CVE-2013-0592 | Medium | 5.4 | 2018-07-11 | Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or H… |
CVE-2013-0589 | High | 7.5 | 2018-07-11 | IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information… |
CVE-2013-3017 | High | 7.5 | 2018-07-09 | IBM Tivoli Application Dependency Discovery Manager (TADDM) before 7.2.1.5 and 7.2.x before 7.2.2 make it easier for remote attackers to defeat cryptographic p… |
CVE-2013-3001 | High | 7.5 | 2018-07-09 | Directory traversal vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to read arbitrary files via unspecified vec… |
CVE-2013-3000 | Critical | 9.8 | 2018-07-09 | SQL injection vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to execute arbitrary SQL commands via unspecified… |
CVE-2013-2999 | Medium | 6.1 | 2018-07-09 | Cross-site scripting (XSS) vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to inject arbitrary web script or HT… |
CVE-2013-3703 | High | 8.8 | 2018-06-08 | The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove us… |
CVE-2013-3024 | High | 7.8 | 2018-05-24 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-F… |
CVE-2013-3023 | High | 8.1 | 2018-05-24 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about… |
CVE-2013-3018 | Medium | 5.3 | 2018-05-24 | The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to… |
CVE-2013-2233 | High | 7.4 | 2018-05-04 | Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. |
CVE-2013-6272 | High | 7.8 | 2018-05-02 | The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass intended access restr… |
CVE-2013-4209 | Low | 3.3 | 2018-05-01 | Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums. |
CVE-2013-4201 | Medium | 4.3 | 2018-05-01 | Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions. |
CVE-2013-2049 | High | 7.5 | 2018-05-01 | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret. |
CVE-2013-0185 | High | 8.8 | 2018-05-01 | Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of use… |
CVE-2013-0159 | High | 7.1 | 2018-05-01 | The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service… |
CVE-2013-4040 | Medium | 5.5 | 2018-05-01 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (755) for unspecified… |
CVE-2013-4035 | High | 7.3 | 2018-05-01 | IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leveraging failure to r… |
CVE-2013-7202 | High | 8.1 | 2018-04-27 | The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system. |
CVE-2013-7201 | High | 7.4 | 2018-04-27 | WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive i… |
CVE-2013-6739 | Medium | 5.4 | 2018-04-27 | IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855. |
CVE-2013-5461 | High | 8.8 | 2018-04-27 | IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which makes it easier for r… |
CVE-2013-5391 | Medium | 5.3 | 2018-04-27 | IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise E… |
CVE-2013-7245 | High | 7.5 | 2018-04-24 | The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging f… |
CVE-2013-3947 | High | 7.8 | 2018-04-24 | Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Security 8.0.7.5 (Build 1373) allows local users to gain privileges via a crafted 0xA3350014 IOCTL call. |
CVE-2013-6876 | High | 7.8 | 2018-04-06 | The (1) pty_init_terminal and (2) pipe_init_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid… |
CVE-2013-4891 | Medium | 6.1 | 2018-02-21 | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XS… |
CVE-2013-0267 | High | 8.8 | 2018-02-21 | The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nod… |
CVE-2013-3553 | High | 7.8 | 2018-02-08 | Nitro Pro 7.5.0.22 and earlier and Nitro Reader 2.5.0.36 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file. |
CVE-2013-3552 | High | 7.8 | 2018-02-08 | Nitro Pro 7.5.0.29 and earlier and Nitro Reader 2.5.0.45 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file. |
CVE-2013-2830 | High | 7.8 | 2018-02-08 | Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file. |
CVE-2013-4317 | Medium | 4.3 | 2018-02-06 | In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see i… |
CVE-2013-7435 | Medium | 6.5 | 2018-02-01 | The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history… |
CVE-2013-4364 | High | 7.8 | 2018-01-08 | (1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to ha… |
CVE-2013-4578 | Medium | 5.3 | 2017-12-29 | jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a s… |
CVE-2013-7400 | High | 7.5 | 2017-12-29 | The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authe… |
CVE-2013-6465 | Medium | 5.4 | 2017-12-19 | Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vec… |
CVE-2013-4366 | Critical | 9.8 | 2017-10-30 | http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers t… |
CVE-2013-4246 | High | 8.8 | 2017-10-30 | libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a… |