CVEs

388,095 total · page 6580 of 7,762

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-1780	Xen Xen	0.00	—	0.01	Jan 7, 2014	The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replacing the instruction that causes the VM to exit in one thread with a different instruction in a different thread.
CVE-2011-1763	Xen Xen	0.00	—	0.01	Jan 7, 2014	The get_free_port function in Xen allows local authenticated DomU users to cause a denial of service or possibly gain privileges via unspecified vectors involving a new event channel port.
CVE-2011-1166	Xen Xen	0.00	—	0.01	Jan 7, 2014	Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.
CVE-2013-6480	Apache Libcloud	0.00	—	0.02	Jan 7, 2014	Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
CVE-2013-6419	OpenStack Havana	0.00	—	0.02	Jan 7, 2014	Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not…
CVE-2013-4969	Puppet (software) Puppet	0.00	—	0.00	Jan 7, 2014	Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
CVE-2013-6888	Devscripts Devel Team Devscripts	0.00	—	0.04	Jan 7, 2014	Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
CVE-2013-6884	Cru Inc Ditto Forensic Fieldstation	0.04	—	0.10	Jan 7, 2014	The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges.
CVE-2013-6881	Cru Inc Ditto Forensic Fieldstation	0.04	—	0.13	Jan 7, 2014	CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
CVE-2013-4564	Libreswan Libreswan	0.00	—	0.03	Jan 7, 2014	Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet.
CVE-2013-7271	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom,…
CVE-2013-7270	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7269	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7268	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom,…
CVE-2013-7267	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7266	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory…
CVE-2013-7265	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1)…
CVE-2013-7264	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1)…
CVE-2013-7263	Linux Kernel	0.00	—	0.00	Jan 6, 2014	The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call,…
CVE-2013-7262	MapServer Mapserver	0.00	—	0.02	Jan 5, 2014	SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
CVE-2013-6402	Microfocus Linux Imaging And Printing Project	0.00	—	0.00	Jan 5, 2014	base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
CVE-2012-2899	Google Chrome	0.00	—	0.01	Jan 5, 2014	Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write…
CVE-2012-2898	Google Chrome	0.00	—	0.01	Jan 5, 2014	Google Chrome before 21.0.1180.82 on iOS on iPad devices allows remote attackers to spoof the Omnibox URL via vectors involving SSL error messages, a related issue to CVE-2012-0674.
CVE-2013-6195	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-2008.
CVE-2013-6194	Microfocus Storage Data Protector	0.08	—	0.66	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905.
CVE-2013-2350	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1897.
CVE-2013-2349	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1896.
CVE-2013-2348	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1892.
CVE-2013-2347	Microfocus Storage Data Protector	0.08	—	0.66	Jan 4, 2014	The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port 5555, aka ZDI-CAN-1885.
CVE-2013-2346	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1870.
CVE-2013-2345	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1869.
CVE-2013-2344	Microfocus Storage Data Protector	0.01	—	0.10	Jan 4, 2014	Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1866.
CVE-2013-7260	RealNetworks Realplayer	0.08	—	0.67	Jan 3, 2014	Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file,…
CVE-2009-5137	Mini Stream Castripper	0.03	—	0.04	Jan 3, 2014	Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long URL in the [playlist] section in a .pls file, a different vector than CVE-2009-1667.
CVE-2013-6953	BlogEngine.NET BlogEngine.NET	0.00	—	0.01	Jan 3, 2014	BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
CVE-2014-0791	Freerdp Freerdp	0.00	—	0.02	Jan 3, 2014	Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a…
CVE-2013-2119	Phusion Passenger	0.00	—	0.00	Jan 3, 2014	Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the…
CVE-2013-7258	Jqhph Web2ldap	0.00	—	0.02	Jan 3, 2014	Cross-site scripting (XSS) vulnerability in web2ldap 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "displaying group DN and entry data in group administration UI."
CVE-2013-7257	Codiad Codiad	0.00	—	0.02	Jan 3, 2014	Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML via the Project Name field.
CVE-2013-7256	Opsview Opsview	0.00	—	0.01	Jan 3, 2014	Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2013-7255	Opsview Opsview	0.00	—	0.01	Jan 3, 2014	Open redirect vulnerability in Opsview before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-7254	Opsview Opsview	0.00	—	0.01	Jan 3, 2014	Cross-site scripting (XSS) vulnerability in Opsview before 4.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-7240	WordPress WordPress	0.05	—	0.20	Jan 3, 2014	Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
CVE-2013-6993	WordPress Ad-minister	0.00	—	0.02	Jan 3, 2014	Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
CVE-2013-6992	Askapache Firefox Adsense	0.00	—	0.01	Jan 3, 2014	Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS)…
CVE-2013-6991	WordPress WP-Cron Dashboard	0.00	—	0.02	Jan 3, 2014	Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php.
CVE-2013-7251	Projectforge Projectforge	0.00	—	0.01	Jan 2, 2014	Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fibu/, (5) web/mobile/, (6) web/task/, or…
CVE-2013-7250	Projectforge Projectforge	0.00	—	0.01	Jan 2, 2014	Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and…
CVE-2013-7249	Fatfreecrm Fatfreecrm	0.00	—	0.03	Jan 2, 2014	Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.
CVE-2013-7225	Fatfreecrm Fatfreecrm	0.00	—	0.02	Jan 2, 2014	Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

CVE-2011-1780Jan 7, 2014
Xen
Xen
risk 0.00cvss —epss 0.01
The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replacing the instruction that causes the VM to exit in one thread with a different instruction in a different thread.
CVE-2011-1763Jan 7, 2014
Xen
Xen
risk 0.00cvss —epss 0.01
The get_free_port function in Xen allows local authenticated DomU users to cause a denial of service or possibly gain privileges via unspecified vectors involving a new event channel port.
CVE-2011-1166Jan 7, 2014
Xen
Xen
risk 0.00cvss —epss 0.01
Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.
CVE-2013-6480Jan 7, 2014
Apache
Libcloud
risk 0.00cvss —epss 0.02
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
CVE-2013-6419Jan 7, 2014
OpenStack
Havana
risk 0.00cvss —epss 0.02
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not…
CVE-2013-4969Jan 7, 2014
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
CVE-2013-6888Jan 7, 2014
Devscripts Devel Team
Devscripts
risk 0.00cvss —epss 0.04
Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
CVE-2013-6884Jan 7, 2014
Cru Inc
Ditto Forensic Fieldstation
risk 0.04cvss —epss 0.10
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges.
CVE-2013-6881Jan 7, 2014
Cru Inc
Ditto Forensic Fieldstation
risk 0.04cvss —epss 0.13
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
CVE-2013-4564Jan 7, 2014
Libreswan
Libreswan
risk 0.00cvss —epss 0.03
Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet.
CVE-2013-7271Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom,…
CVE-2013-7270Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7269Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7268Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom,…
CVE-2013-7267Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1)…
CVE-2013-7266Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory…
CVE-2013-7265Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1)…
CVE-2013-7264Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1)…
CVE-2013-7263Jan 6, 2014
Linux
Kernel
risk 0.00cvss —epss 0.00
The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call,…
CVE-2013-7262Jan 5, 2014
MapServer
Mapserver
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
CVE-2013-6402Jan 5, 2014
Microfocus
Linux Imaging And Printing Project
risk 0.00cvss —epss 0.00
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
CVE-2012-2899Jan 5, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write…
CVE-2012-2898Jan 5, 2014
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 21.0.1180.82 on iOS on iPad devices allows remote attackers to spoof the Omnibox URL via vectors involving SSL error messages, a related issue to CVE-2012-0674.
CVE-2013-6195Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-2008.
CVE-2013-6194Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.08cvss —epss 0.66
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905.
CVE-2013-2350Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1897.
CVE-2013-2349Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1896.
CVE-2013-2348Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1892.
CVE-2013-2347Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.08cvss —epss 0.66
The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port 5555, aka ZDI-CAN-1885.
CVE-2013-2346Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1870.
CVE-2013-2345Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1869.
CVE-2013-2344Jan 4, 2014
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1866.
CVE-2013-7260Jan 3, 2014
RealNetworks
Realplayer
risk 0.08cvss —epss 0.67
Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file,…
CVE-2009-5137Jan 3, 2014
Mini Stream
Castripper
risk 0.03cvss —epss 0.04
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long URL in the [playlist] section in a .pls file, a different vector than CVE-2009-1667.
CVE-2013-6953Jan 3, 2014
BlogEngine.NET
BlogEngine.NET
risk 0.00cvss —epss 0.01
BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
CVE-2014-0791Jan 3, 2014
Freerdp
Freerdp
risk 0.00cvss —epss 0.02
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a…
CVE-2013-2119Jan 3, 2014
Phusion
Passenger
risk 0.00cvss —epss 0.00
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the…
CVE-2013-7258Jan 3, 2014
Jqhph
Web2ldap
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in web2ldap 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "displaying group DN and entry data in group administration UI."
CVE-2013-7257Jan 3, 2014
Codiad
Codiad
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML via the Project Name field.
CVE-2013-7256Jan 3, 2014
Opsview
Opsview
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2013-7255Jan 3, 2014
Opsview
Opsview
risk 0.00cvss —epss 0.01
Open redirect vulnerability in Opsview before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-7254Jan 3, 2014
Opsview
Opsview
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Opsview before 4.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-7240Jan 3, 2014
WordPress
WordPress
risk 0.05cvss —epss 0.20
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
CVE-2013-6993Jan 3, 2014
WordPress
Ad-minister
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php.
CVE-2013-6992Jan 3, 2014
Askapache
Firefox Adsense
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS)…
CVE-2013-6991Jan 3, 2014
WordPress
WP-Cron Dashboard
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php.
CVE-2013-7251Jan 2, 2014
Projectforge
Projectforge
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fibu/, (5) web/mobile/, (6) web/task/, or…
CVE-2013-7250Jan 2, 2014
Projectforge
Projectforge
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and…
CVE-2013-7249Jan 2, 2014
Fatfreecrm
Fatfreecrm
risk 0.00cvss —epss 0.03
Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.
CVE-2013-7225Jan 2, 2014
Fatfreecrm
Fatfreecrm
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.