CVEs

347,168 total · page 5843 of 6,944

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2013-0675	Siemens Foundation Wincc	0.00	—	0.01	Mar 21, 2013	Buffer overflow in CCEServer (aka the central communications component) in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet.
CVE-2013-0674	Siemens Foundation Wincc	0.00	—	0.03	Mar 21, 2013	Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter.
CVE-2013-0672	Siemens Foundation Wincc Tia Portal	0.00	—	0.01	Mar 21, 2013	Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
CVE-2013-0671	Siemens Foundation Wincc Tia Portal	0.00	—	0.02	Mar 21, 2013	Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.
CVE-2013-0670	Siemens Foundation Wincc	0.00	—	0.02	Mar 21, 2013	CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVE-2013-0669	Siemens Foundation Wincc Tia Portal	0.00	—	0.02	Mar 21, 2013	The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
CVE-2013-0668	Siemens Foundation Wincc Tia Portal	0.00	—	0.02	Mar 21, 2013	Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0667	Siemens Foundation Wincc Tia Portal	0.00	—	0.02	Mar 21, 2013	Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0665	Selinc Acselerator Quickset	0.00	—	0.01	Mar 21, 2013	Schweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations.
CVE-2011-4515	Siemens Foundation Wincc Tia Portal	0.00	—	0.00	Mar 21, 2013	Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging (1) physical access or (2) Sm@rt Server access.
CVE-2013-2617	Curl Project Curl	0.00	—	0.04	Mar 20, 2013	lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-2616	RubyGems Mini Magick	0.00	—	0.04	Mar 20, 2013	lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-2615	RubyGems Fastreader	0.00	—	0.02	Mar 20, 2013	lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-1875	RubyGems Command Wrap	0.00	—	0.04	Mar 20, 2013	command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
CVE-2013-1750	RealNetworks Realplayer	0.00	—	0.03	Mar 20, 2013	Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a malformed MP4 file.
CVE-2013-0716	Windriver Vxworks	0.00	—	0.02	Mar 20, 2013	The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.
CVE-2013-0715	Windriver Vxworks	0.00	—	0.02	Mar 20, 2013	The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.
CVE-2013-0714	Windriver Vxworks	0.01	—	0.06	Mar 20, 2013	IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.
CVE-2013-0713	Windriver Vxworks	0.00	—	0.02	Mar 20, 2013	IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.
CVE-2013-0712	Windriver Vxworks	0.00	—	0.03	Mar 20, 2013	IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.
CVE-2013-0711	Windriver Vxworks	0.00	—	0.03	Mar 20, 2013	IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.
CVE-2013-2275	Puppet (software) Puppet	0.00	—	0.03	Mar 20, 2013	The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified…
CVE-2013-2274	Puppet (software) Puppet	0.00	—	0.03	Mar 20, 2013	Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
CVE-2013-1655	Puppet (software) Puppet	0.00	—	0.05	Mar 20, 2013	Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
CVE-2013-1654	Puppet (software) Puppet	0.00	—	0.03	Mar 20, 2013	Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
CVE-2013-1653	Puppet (software) Puppet	0.00	—	0.05	Mar 20, 2013	Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to…
CVE-2013-1652	Puppet (software) Puppet	0.00	—	0.02	Mar 20, 2013	Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
CVE-2013-1640	Puppet (software) Puppet	0.00	—	0.05	Mar 20, 2013	The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted…
CVE-2013-1843	TYPO3 Typo3	0.00	—	0.02	Mar 20, 2013	Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-1842	TYPO3 Typo3	0.00	—	0.03	Mar 20, 2013	SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation…
CVE-2013-1766	Libvirt Libvirt	0.00	—	0.00	Mar 20, 2013	libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
CVE-2013-0332	Zoneminder Zoneminder	0.04	—	0.10	Mar 20, 2013	Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
CVE-2013-0232	Zoneminder Zoneminder	0.07	—	0.48	Mar 20, 2013	includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the…
CVE-2013-0981	Apple Inc. iOS	0.00	—	0.00	Mar 20, 2013	The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.
CVE-2013-0980	Apple Inc. iOS	0.00	—	0.00	Mar 20, 2013	The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.
CVE-2013-0979	Apple Inc. iOS	0.00	—	0.00	Mar 20, 2013	lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
CVE-2013-0978	Apple Inc. iOS	0.00	—	0.00	Mar 20, 2013	The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
CVE-2013-0977	Apple Inc. iOS	0.00	—	0.00	Mar 20, 2013	dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.
CVE-2012-5938	IBM Infosphere Information Server	0.00	—	0.00	Mar 20, 2013	The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations.
CVE-2013-1857	Rubyonrails Rails	0.00	—	0.02	Mar 19, 2013	The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it…
CVE-2013-1856	Rubyonrails Rails	0.00	—	0.02	Mar 19, 2013	The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows…
CVE-2013-1855	Rubyonrails Rails	0.00	—	0.03	Mar 19, 2013	The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for…
CVE-2013-1854	Rubyonrails Rails	0.00	—	0.03	Mar 19, 2013	The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
CVE-2013-0717	NEC Atermwm3450rn	0.00	—	0.01	Mar 19, 2013	Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for…
CVE-2013-0506	IBM Sterling Order Management	0.00	—	0.01	Mar 19, 2013	Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0505	IBM Sterling Order Management	0.00	—	0.01	Mar 19, 2013	IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
CVE-2013-1863	Samba (software) Samba	0.00	—	0.02	Mar 19, 2013	Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.
CVE-2013-2263	Citrix Systems Access Gateway	0.00	—	0.01	Mar 19, 2013	Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.
CVE-2013-0331	Jenkins Project Jenkins	0.00	—	0.02	Mar 19, 2013	Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
CVE-2013-0330	Jenkins Project Jenkins	0.00	—	0.02	Mar 19, 2013	Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

CVE-2013-0675Mar 21, 2013
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.01
Buffer overflow in CCEServer (aka the central communications component) in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet.
CVE-2013-0674Mar 21, 2013
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.03
Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter.
CVE-2013-0672Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
CVE-2013-0671Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.
CVE-2013-0670Mar 21, 2013
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.02
CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVE-2013-0669Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.02
The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
CVE-2013-0668Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0667Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0665Mar 21, 2013
Selinc
Acselerator Quickset
risk 0.00cvss —epss 0.01
Schweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations.
CVE-2011-4515Mar 21, 2013
Siemens Foundation
Wincc Tia Portal
risk 0.00cvss —epss 0.00
Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging (1) physical access or (2) Sm@rt Server access.
CVE-2013-2617Mar 20, 2013
Curl Project
Curl
risk 0.00cvss —epss 0.04
lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-2616Mar 20, 2013
RubyGems
Mini Magick
risk 0.00cvss —epss 0.04
lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-2615Mar 20, 2013
RubyGems
Fastreader
risk 0.00cvss —epss 0.02
lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVE-2013-1875Mar 20, 2013
RubyGems
Command Wrap
risk 0.00cvss —epss 0.04
command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
CVE-2013-1750Mar 20, 2013
RealNetworks
Realplayer
risk 0.00cvss —epss 0.03
Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a malformed MP4 file.
CVE-2013-0716Mar 20, 2013
Windriver
Vxworks
risk 0.00cvss —epss 0.02
The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.
CVE-2013-0715Mar 20, 2013
Windriver
Vxworks
risk 0.00cvss —epss 0.02
The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.
CVE-2013-0714Mar 20, 2013
Windriver
Vxworks
risk 0.01cvss —epss 0.06
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.
CVE-2013-0713Mar 20, 2013
Windriver
Vxworks
risk 0.00cvss —epss 0.02
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.
CVE-2013-0712Mar 20, 2013
Windriver
Vxworks
risk 0.00cvss —epss 0.03
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.
CVE-2013-0711Mar 20, 2013
Windriver
Vxworks
risk 0.00cvss —epss 0.03
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.
CVE-2013-2275Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.03
The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified…
CVE-2013-2274Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.03
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
CVE-2013-1655Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.05
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
CVE-2013-1654Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.03
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
CVE-2013-1653Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.05
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to…
CVE-2013-1652Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.02
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
CVE-2013-1640Mar 20, 2013
Puppet (software)
Puppet
risk 0.00cvss —epss 0.05
The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted…
CVE-2013-1843Mar 20, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.02
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-1842Mar 20, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.03
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation…
CVE-2013-1766Mar 20, 2013
Libvirt
Libvirt
risk 0.00cvss —epss 0.00
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
CVE-2013-0332Mar 20, 2013
Zoneminder
Zoneminder
risk 0.04cvss —epss 0.10
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
CVE-2013-0232Mar 20, 2013
Zoneminder
Zoneminder
risk 0.07cvss —epss 0.48
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the…
CVE-2013-0981Mar 20, 2013
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.
CVE-2013-0980Mar 20, 2013
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.
CVE-2013-0979Mar 20, 2013
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
CVE-2013-0978Mar 20, 2013
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
CVE-2013-0977Mar 20, 2013
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.
CVE-2012-5938Mar 20, 2013
IBM
Infosphere Information Server
risk 0.00cvss —epss 0.00
The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations.
CVE-2013-1857Mar 19, 2013
Rubyonrails
Rails
risk 0.00cvss —epss 0.02
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it…
CVE-2013-1856Mar 19, 2013
Rubyonrails
Rails
risk 0.00cvss —epss 0.02
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows…
CVE-2013-1855Mar 19, 2013
Rubyonrails
Rails
risk 0.00cvss —epss 0.03
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for…
CVE-2013-1854Mar 19, 2013
Rubyonrails
Rails
risk 0.00cvss —epss 0.03
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
CVE-2013-0717Mar 19, 2013
NEC
Atermwm3450rn
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for…
CVE-2013-0506Mar 19, 2013
IBM
Sterling Order Management
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0505Mar 19, 2013
IBM
Sterling Order Management
risk 0.00cvss —epss 0.01
IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
CVE-2013-1863Mar 19, 2013
Samba (software)
Samba
risk 0.00cvss —epss 0.02
Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.
CVE-2013-2263Mar 19, 2013
Citrix Systems
Access Gateway
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.
CVE-2013-0331Mar 19, 2013
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
CVE-2013-0330Mar 19, 2013
Jenkins Project
Jenkins
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.