2013 CVEs (page 7)
Page 7 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-3734 | Medium | 6.6 | 2017-10-24 | The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-… |
CVE-2013-7377 | High | 8.1 | 2017-10-23 | The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /prob… |
CVE-2013-6049 | High | 7.8 | 2017-10-20 | apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors. |
CVE-2013-6924 | Critical | 9.8 | 2017-10-11 | Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter… |
CVE-2013-7429 | Critical | 9.8 | 2017-09-14 | The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php. |
CVE-2013-7428 | High | 7.5 | 2017-09-07 | The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php. |
CVE-2013-7433 | Medium | 6.1 | 2017-08-29 | Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!. |
CVE-2013-7432 | High | 7.5 | 2017-08-29 | The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism. |
CVE-2013-7431 | Medium | 5.3 | 2017-08-29 | Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!. |
CVE-2013-7426 | Critical | 9.8 | 2017-08-29 | Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. |
CVE-2013-7430 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2013-0870 | Critical | 9.8 | 2017-08-28 | The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check. |
CVE-2013-7463 | High | 7.5 | 2017-04-19 | The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defea… |
CVE-2013-6662 | Medium | 6.5 | 2017-04-13 | Google Chrome caches TLS sessions before certificate validation occurs. |
CVE-2013-6648 | High | 7.5 | 2017-04-13 | SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash). |
CVE-2013-6647 | Critical | 9.8 | 2017-04-11 | A use-after-free in AnimationController::endAnimationUpdate in Google Chrome. |
CVE-2013-7450 | High | 7.5 | 2017-04-03 | Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. |
CVE-2013-6446 | Low | 3.1 | 2017-03-23 | The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated… |
CVE-2013-7462 | High | 7.5 | 2017-03-14 | A directory traversal vulnerability in the web application in McAfee (now Intel Security) SaaS Control Console (SCC) Platform 6.14 before patch 1070, and 6.15… |
CVE-2013-7461 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated user… |
CVE-2013-7460 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Application Control (MAC) 6.1.0 for Linux and earlier allows authenticated… |
CVE-2013-4659 | Critical | 9.8 | 2017-03-14 | Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. This component is used on routers of mul… |
CVE-2013-5653 | Medium | 5.5 | 2017-03-07 | The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript… |
CVE-2013-7459 | Critical | 9.8 | 2017-02-15 | Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrar… |
CVE-2013-7454 | Medium | 6.1 | 2017-01-23 | The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings. |
CVE-2013-7453 | Medium | 6.1 | 2017-01-23 | The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing. |
CVE-2013-7452 | Medium | 6.1 | 2017-01-23 | The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI. |
CVE-2013-7451 | Medium | 6.1 | 2017-01-23 | The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag. |
CVE-2013-1430 | Critical | 9.8 | 2016-12-16 | An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created… |
CVE-2013-4119 | High | 7.5 | 2016-10-03 | FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting bef… |
CVE-2013-4118 | High | 7.5 | 2016-10-03 | FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. |
CVE-2013-7458 | Low | 3.3 | 2016-08-10 | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by re… |
CVE-2013-7456 | High | 7.6 | 2016-08-07 | gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote… |
CVE-2013-7457 | High | 7.8 | 2016-07-11 | Unspecified vulnerability in the Qualcomm components in Android before 2016-07-05 allows attackers to gain privileges via a crafted application. |
CVE-2013-7440 | Medium | 5.9 | 2016-06-07 | The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow ma… |
CVE-2013-7455 | Critical | 9.8 | 2016-05-07 | Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary… |
CVE-2013-7449 | Medium | 6.5 | 2016-04-21 | The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name… |
CVE-2013-7448 | High | 7.5 | 2016-02-23 | Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get. |
CVE-2013-7447 | Medium | 6.5 | 2016-02-17 | Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoi… |
CVE-2013-4312 | Medium | 6.2 | 2016-02-08 | The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor… |
CVE-2013-7446 | Medium | 5.3 | 2015-12-28 | Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a… |
CVE-2013-5229 | | 2015-11-14 | The Remote Desktop full-screen feature in Apple OS X before 10.9 and Apple Remote Desktop before 3.7 sends dialog-box text to a connected remote host upon bein… | |
CVE-2013-7445 | | 2015-10-16 | The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows con… | |
CVE-2013-7444 | | 2015-09-01 | The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. | |
CVE-2013-7424 | | 2015-08-26 | The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of s… | |
CVE-2013-7422 | | 2015-08-16 | Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbi… | |
CVE-2013-7443 | | 2015-08-12 | Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements. | |
CVE-2013-7442 | | 2015-08-04 | GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user, which has unspeci… | |
CVE-2013-7405 | | 2015-08-04 | The Ad Hoc Reporting feature in GE Healthcare Centricity DMS 4.2 has a password of Never!Mind for the Administrator user, which has unspecified impact and atta… | |
CVE-2013-7404 | | 2015-08-04 | GE Healthcare Discovery NM 750b has a password of 2getin for the insite account for (1) Telnet and (2) FTP, which has unspecified impact and attack vectors. N… | |
CVE-2013-7398 | | 2015-06-24 | main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match du… | |
CVE-2013-7397 | | 2015-06-24 | Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location ar… | |
CVE-2013-7441 | | 2015-05-29 | The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termina… | |
CVE-2013-4866 | | 2015-04-16 | The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attackers to trigger phys… | |
CVE-2013-7439 | | 2015-04-16 | Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to… | |
CVE-2013-7436 | | 2015-04-10 | noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepti… | |
CVE-2013-6501 | | 2015-03-30 | The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it… | |
CVE-2013-7438 | | 2015-03-29 | Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PBM image… | |
CVE-2013-7437 | | 2015-03-29 | Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a bu… | |
CVE-2013-2184 | | 2015-03-27 | Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state para… | |
CVE-2013-7421 | | 2015-03-02 | The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module… | |
CVE-2013-7423 | | 2015-02-24 | The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attac… | |
CVE-2013-2027 | | 2015-02-13 | Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspeci… | |
CVE-2013-5557 | | 2015-02-07 | The Proxy Bypass Content Rewriter feature in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software 9.1(.2) and earlier allows remote authent… | |
CVE-2013-6892 | | 2015-01-21 | WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit. | |
CVE-2013-7252 | | 2015-01-18 | kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier f… | |
CVE-2013-2604 | | 2015-01-12 | RealNetworks GameHouse RealArcade Installer (aka ActiveMARK Game Installer) 2.6.0.481 and 3.0.7 uses weak permissions (Create Files/Write Data) for the GameHou… | |
CVE-2013-2603 | | 2015-01-12 | The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions… | |
CVE-2013-7420 | | 2015-01-12 | Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary via a long string in the Text attribute in a TEXTART XML element in an HM… | |
CVE-2013-7419 | | 2015-01-09 | Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for W… | |
CVE-2013-2131 | | 2015-01-04 | Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash)… | |
CVE-2013-7418 | | 2015-01-02 | cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the… | |
CVE-2013-7417 | | 2015-01-02 | Cross-site scripting (XSS) vulnerability in cgi-bin/ipinfo.cgi in IPCop (aka IPCop Firewall) before 2.1.3 allows remote attackers to inject arbitrary web scrip… | |
CVE-2013-3295 | | 2014-12-30 | Directory traversal vulnerability in install/popup.php in Exponent CMS before 2.2.0 RC1 allows remote attackers to include and execute arbitrary local files vi… | |
CVE-2013-4663 | | 2014-12-28 | git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the… | |
CVE-2013-6919 | | 2014-12-27 | The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Reques… | |
CVE-2013-6241 | | 2014-12-27 | The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, d… | |
CVE-2013-6227 | | 2014-12-27 | Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote… | |
CVE-2013-6043 | | 2014-12-27 | The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user accou… | |
CVE-2013-6041 | | 2014-12-27 | index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within… | |
CVE-2013-5958 | | 2014-12-27 | The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denia… | |
CVE-2013-4793 | | 2014-12-27 | The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentic… | |
CVE-2013-4769 | | 2014-12-26 | The cloud controller (aka CLC) component in Eucalyptus 3.3.x and 3.4.x before 3.4.2, when the dns.recursive.enabled setting is used, allows remote attackers to… | |
CVE-2013-4754 | | 2014-12-26 | Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML… | |
CVE-2013-4753 | | 2014-12-26 | Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via… | |
CVE-2013-7401 | | 2014-12-19 | The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character i… | |
CVE-2013-4442 | | 2014-12-19 | Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent att… | |
CVE-2013-4440 | | 2014-12-19 | Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a… | |
CVE-2013-7402 | | 2014-12-17 | Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request. | |
CVE-2013-6435 | | 2014-12-16 | Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to t… | |
CVE-2013-4399 | | 2014-12-12 | The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal… | |
CVE-2013-2810 | | 2014-12-08 | Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier… | |
CVE-2013-7416 | | 2014-12-03 | canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed. | |
CVE-2013-6494 | | 2014-12-02 | fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of servic… | |
CVE-2013-6497 | | 2014-12-01 | clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file. | |
CVE-2013-3678 | | 2014-11-19 | Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary pr… | |
CVE-2013-0347 | | 2014-11-16 | The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the fi… | |
CVE-2013-3737 | | 2014-11-16 | The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Se… | |
CVE-2013-6399 | | 2014-11-04 | Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm… | |
CVE-2013-4542 | | 2014-11-04 | The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm im… |