CVEs

347,168 total · page 5845 of 6,944

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2013-1468	Piwigo Piwigo		0.03	—	0.06		Mar 14, 2013	Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
CVE-2013-1423	Fusionforge Fusionforge		0.00	—	0.00		Mar 14, 2013	(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8)…
CVE-2013-1049	Debian Cfingerd		0.00	—	0.03		Mar 14, 2013	Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.
CVE-2013-0275	Ganglia Web		0.00	—	0.02		Mar 14, 2013	Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4462	Condor Project Condor		0.00	—	0.02		Mar 14, 2013	aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.
CVE-2012-4460	Apache Qpid		0.00	—	0.03		Mar 14, 2013	The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read,…
CVE-2012-4459	Apache Qpid		0.01	—	0.09		Mar 14, 2013	Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
CVE-2012-4458	Apache Qpid		0.01	—	0.07		Mar 14, 2013	The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
CVE-2012-4446	Apache Qpid		0.00	—	0.05		Mar 14, 2013	The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
CVE-2013-1814	Apache Rave		0.02	—	0.74		Mar 14, 2013	The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
CVE-2013-1469	Piwigo Piwigo		0.07	—	0.56		Mar 13, 2013	Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVE-2013-0312	Fedoraproject 389 Directory Server		0.00	—	0.03		Mar 13, 2013	389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
CVE-2013-1375	Adobe Inc. Air		0.01	—	0.09		Mar 13, 2013	Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before…
CVE-2013-1371	Adobe Inc. Air		0.00	—	0.05		Mar 13, 2013	Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK…
CVE-2013-0650	Adobe Inc. Air		0.01	—	0.07		Mar 13, 2013	Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR…
CVE-2013-0646	Adobe Inc. Air		0.01	—	0.07		Mar 13, 2013	Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before…
CVE-2013-2558	Microsoft Windows 8		0.01	—	0.14		Mar 13, 2013	Unspecified vulnerability in Microsoft Windows 8 allows remote attackers to cause a denial of service (reboot) or possibly have unknown other impact via a crafted TrueType Font (TTF) file, as demonstrated by the 120612-69701-01.dmp error report.
CVE-2013-1288	Microsoft Internet Explorer		0.01	—	0.18		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CTreeNode Use After Free Vulnerability."
CVE-2013-1287	Microsoft Windows		0.00	—	0.01		Mar 13, 2013	The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-1286	Microsoft Windows		0.00	—	0.01		Mar 13, 2013	The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-1285	Microsoft Windows		0.00	—	0.01		Mar 13, 2013	The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-0095	Microsoft Office		0.02	—	0.21		Mar 13, 2013	Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the…
CVE-2013-0094	Microsoft Internet Explorer		0.01	—	0.18		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer removeChild Use After Free Vulnerability."
CVE-2013-0093	Microsoft Internet Explorer		0.01	—	0.18		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer onBeforeCopy Use After Free Vulnerability."
CVE-2013-0092	Microsoft Internet Explorer		0.02	—	0.28		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability."
CVE-2013-0091	Microsoft Internet Explorer		0.02	—	0.20		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."
CVE-2013-0090	Microsoft Internet Explorer	Hig	0.63	8.8	0.38		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."
CVE-2013-0089	Microsoft Internet Explorer		0.01	—	0.18		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkupBehaviorContext Use After Free Vulnerability."
CVE-2013-0088	Microsoft Internet Explorer		0.02	—	0.20		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer saveHistory Use After Free Vulnerability."
CVE-2013-0087	Microsoft Internet Explorer		0.01	—	0.18		Mar 13, 2013	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer OnResize Use After Free Vulnerability."
CVE-2013-0086	Microsoft Onenote		0.02	—	0.24		Mar 13, 2013	Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."
CVE-2013-0085	Microsoft Sharepoint Server		0.03	—	0.34		Mar 13, 2013	Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow Vulnerability."
CVE-2013-0084	Microsoft Sharepoint Server		0.02	—	0.21		Mar 13, 2013	Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."
CVE-2013-0083	Microsoft Sharepoint Server		0.01	—	0.14		Mar 13, 2013	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."
CVE-2013-0080	Microsoft Sharepoint Server		0.02	—	0.19		Mar 13, 2013	Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."
CVE-2013-0079	Microsoft Visio		0.02	—	0.27		Mar 13, 2013	Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."
CVE-2013-0074	Microsoft Silverlight	Hig	0.78	7.8	0.82	KEV	Mar 13, 2013	Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference…
CVE-2013-0239	Apache Cxf		0.00	—	0.05		Mar 12, 2013	Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password…
CVE-2013-0168	Red Hat Enterprise Virtualization		0.00	—	0.02		Mar 12, 2013	The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via…
CVE-2012-6115	Red Hat Enterprise Virtualization		0.00	—	0.00		Mar 12, 2013	The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information…
CVE-2012-5660	Red Hat Automatic Bug Reporting Tool		0.00	—	0.00		Mar 12, 2013	abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."
CVE-2012-5659	Automatic Bug Reporting Tool (ABRT) ABRT		0.00	—	0.00		Mar 12, 2013	Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a…
CVE-2012-5633	Apache Cxf		0.00	—	0.08		Mar 12, 2013	The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
CVE-2012-5629	Red Hat Jboss Enterprise Application Platform		0.00	—	0.02		Mar 12, 2013	The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
CVE-2011-4966	FreeRADIUS Freeradius		0.00	—	0.01		Mar 12, 2013	modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
CVE-2011-1165	David King Vino		0.00	—	0.02		Mar 12, 2013	Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attackers to perform further attacks.
CVE-2011-1164	David King Vino		0.00	—	0.02		Mar 12, 2013	Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier for remote attackers to perform attacks.
CVE-2013-0252	Boost Boost		0.00	—	0.03		Mar 12, 2013	boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
CVE-2012-6118	Red Hat Aeolus Conductor		0.00	—	0.01		Mar 12, 2013	The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Running Instances quota user setting.
CVE-2012-6117	Red Hat Cloudforms		0.00	—	0.00		Mar 12, 2013	Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file.

CVE-2013-1468Mar 14, 2013
Piwigo
Piwigo
risk 0.03cvss —epss 0.06
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
CVE-2013-1423Mar 14, 2013
Fusionforge
Fusionforge
risk 0.00cvss —epss 0.00
(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8)…
CVE-2013-1049Mar 14, 2013
Debian
Cfingerd
risk 0.00cvss —epss 0.03
Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.
CVE-2013-0275Mar 14, 2013
Ganglia
Web
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4462Mar 14, 2013
Condor Project
Condor
risk 0.00cvss —epss 0.02
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.
CVE-2012-4460Mar 14, 2013
Apache
Qpid
risk 0.00cvss —epss 0.03
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read,…
CVE-2012-4459Mar 14, 2013
Apache
Qpid
risk 0.01cvss —epss 0.09
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
CVE-2012-4458Mar 14, 2013
Apache
Qpid
risk 0.01cvss —epss 0.07
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
CVE-2012-4446Mar 14, 2013
Apache
Qpid
risk 0.00cvss —epss 0.05
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
CVE-2013-1814Mar 14, 2013
Apache
Rave
risk 0.02cvss —epss 0.74
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
CVE-2013-1469Mar 13, 2013
Piwigo
Piwigo
risk 0.07cvss —epss 0.56
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVE-2013-0312Mar 13, 2013
Fedoraproject
389 Directory Server
risk 0.00cvss —epss 0.03
389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
CVE-2013-1375Mar 13, 2013
Adobe Inc.
Air
risk 0.01cvss —epss 0.09
Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before…
CVE-2013-1371Mar 13, 2013
Adobe Inc.
Air
risk 0.00cvss —epss 0.05
Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK…
CVE-2013-0650Mar 13, 2013
Adobe Inc.
Air
risk 0.01cvss —epss 0.07
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR…
CVE-2013-0646Mar 13, 2013
Adobe Inc.
Air
risk 0.01cvss —epss 0.07
Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before…
CVE-2013-2558Mar 13, 2013
Microsoft
Windows 8
risk 0.01cvss —epss 0.14
Unspecified vulnerability in Microsoft Windows 8 allows remote attackers to cause a denial of service (reboot) or possibly have unknown other impact via a crafted TrueType Font (TTF) file, as demonstrated by the 120612-69701-01.dmp error report.
CVE-2013-1288Mar 13, 2013
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.18
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CTreeNode Use After Free Vulnerability."
CVE-2013-1287Mar 13, 2013
Microsoft
Windows
risk 0.00cvss —epss 0.01
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-1286Mar 13, 2013
Microsoft
Windows
risk 0.00cvss —epss 0.01
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-1285Mar 13, 2013
Microsoft
Windows
risk 0.00cvss —epss 0.01
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically…
CVE-2013-0095Mar 13, 2013
Microsoft
Office
risk 0.02cvss —epss 0.21
Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the…
CVE-2013-0094Mar 13, 2013
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.18
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer removeChild Use After Free Vulnerability."
CVE-2013-0093Mar 13, 2013
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.18
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer onBeforeCopy Use After Free Vulnerability."
CVE-2013-0092Mar 13, 2013
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.28
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability."
CVE-2013-0091Mar 13, 2013
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.20
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."
CVE-2013-0090HigMar 13, 2013
Microsoft
Internet Explorer
risk 0.63cvss 8.8epss 0.38
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."
CVE-2013-0089Mar 13, 2013
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.18
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkupBehaviorContext Use After Free Vulnerability."
CVE-2013-0088Mar 13, 2013
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.20
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer saveHistory Use After Free Vulnerability."
CVE-2013-0087Mar 13, 2013
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.18
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer OnResize Use After Free Vulnerability."
CVE-2013-0086Mar 13, 2013
Microsoft
Onenote
risk 0.02cvss —epss 0.24
Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."
CVE-2013-0085Mar 13, 2013
Microsoft
Sharepoint Server
risk 0.03cvss —epss 0.34
Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow Vulnerability."
CVE-2013-0084Mar 13, 2013
Microsoft
Sharepoint Server
risk 0.02cvss —epss 0.21
Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."
CVE-2013-0083Mar 13, 2013
Microsoft
Sharepoint Server
risk 0.01cvss —epss 0.14
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."
CVE-2013-0080Mar 13, 2013
Microsoft
Sharepoint Server
risk 0.02cvss —epss 0.19
Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."
CVE-2013-0079Mar 13, 2013
Microsoft
Visio
risk 0.02cvss —epss 0.27
Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."
CVE-2013-0074HigKEVMar 13, 2013
Microsoft
Silverlight
risk 0.78cvss 7.8epss 0.82
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference…
CVE-2013-0239Mar 12, 2013
Apache
Cxf
risk 0.00cvss —epss 0.05
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password…
CVE-2013-0168Mar 12, 2013
Red Hat
Enterprise Virtualization
risk 0.00cvss —epss 0.02
The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via…
CVE-2012-6115Mar 12, 2013
Red Hat
Enterprise Virtualization
risk 0.00cvss —epss 0.00
The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information…
CVE-2012-5660Mar 12, 2013
Red Hat
Automatic Bug Reporting Tool
risk 0.00cvss —epss 0.00
abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."
CVE-2012-5659Mar 12, 2013
Automatic Bug Reporting Tool (ABRT)
ABRT
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a…
CVE-2012-5633Mar 12, 2013
Apache
Cxf
risk 0.00cvss —epss 0.08
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
CVE-2012-5629Mar 12, 2013
Red Hat
Jboss Enterprise Application Platform
risk 0.00cvss —epss 0.02
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
CVE-2011-4966Mar 12, 2013
FreeRADIUS
Freeradius
risk 0.00cvss —epss 0.01
modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
CVE-2011-1165Mar 12, 2013
David King
Vino
risk 0.00cvss —epss 0.02
Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attackers to perform further attacks.
CVE-2011-1164Mar 12, 2013
David King
Vino
risk 0.00cvss —epss 0.02
Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier for remote attackers to perform attacks.
CVE-2013-0252Mar 12, 2013
Boost
Boost
risk 0.00cvss —epss 0.03
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
CVE-2012-6118Mar 12, 2013
Red Hat
Aeolus Conductor
risk 0.00cvss —epss 0.01
The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Running Instances quota user setting.
CVE-2012-6117Mar 12, 2013
Red Hat
Cloudforms
risk 0.00cvss —epss 0.00
Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file.