CVEs

388,083 total · page 6582 of 7,762

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2013-4554	Xen Xen	0.00	—	0.01	Dec 24, 2013	Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
CVE-2013-4553	Xen Xen	0.00	—	0.01	Dec 24, 2013	The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).
CVE-2013-4452	Red Hat Jboss Operations Network	0.00	—	0.00	Dec 24, 2013	Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.
CVE-2013-4358	FFmpeg Ffmpeg	0.00	—	0.01	Dec 24, 2013	libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data.
CVE-2011-5268	Duckcorp Bip	0.00	—	0.01	Dec 24, 2013	connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550. NOTE: this issue was SPLIT from…
CVE-2013-6795	Rackspace Openstack Windows Guest Agent	0.00	—	0.05	Dec 24, 2013	The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service…
CVE-2013-6403	OwnCloud Owncloud	0.00	—	0.02	Dec 24, 2013	The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB.
CVE-2013-4550	Duckcorp Bip	0.00	—	0.02	Dec 24, 2013	Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed…
CVE-2013-7102	Optimizepress Optimizepress	0.04	—	0.15	Dec 23, 2013	Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file…
CVE-2013-7081	TYPO3 Typo3	0.00	—	0.01	Dec 23, 2013	The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
CVE-2013-7080	TYPO3 Typo3	0.00	—	0.01	Dec 23, 2013	The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted…
CVE-2013-7079	TYPO3 Typo3	0.00	—	0.01	Dec 23, 2013	Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-7075	TYPO3 Typo3	0.00	—	0.01	Dec 23, 2013	The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified…
CVE-2013-7073	TYPO3 Typo3	0.00	—	0.01	Dec 23, 2013	The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
CVE-2013-7049	Znc Msvc znc-msvc	0.00	—	0.02	Dec 23, 2013	Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT message.
CVE-2013-4424	Red Hat Jboss Portal	0.00	—	0.01	Dec 23, 2013	Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-3709	Novell Suse Lifecycle Management Server	0.00	—	0.00	Dec 23, 2013	WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
CVE-2013-6979	Cisco Systems, Inc. iOS Xe	0.00	—	0.04	Dec 23, 2013	The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, aka Bug ID…
CVE-2013-6890	Denyhosts Denyhosts	0.04	—	0.09	Dec 23, 2013	denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.
CVE-2013-6449	OpenSSL Project OpenSSL	0.02	—	0.21	Dec 23, 2013	The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
CVE-2013-6439	Red Hat Subscription Asset Manager	0.00	—	0.02	Dec 23, 2013	Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
CVE-2013-6422	Curl Libcurl	0.00	—	0.03	Dec 23, 2013	The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct…
CVE-2013-5420	IBM Security Access Manager For Enterprise Single Sign On	0.00	—	0.01	Dec 23, 2013	The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to read log files by leveraging helpdesk privileges for a direct request.
CVE-2013-4549	Qt Qt	0.00	—	0.03	Dec 23, 2013	QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
CVE-2013-4461	Red Hat Enterprise Mrg	0.00	—	0.02	Dec 23, 2013	SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator."
CVE-2013-4414	Red Hat Enterprise Mrg	0.00	—	0.02	Dec 23, 2013	Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.
CVE-2013-4405	Red Hat Enterprise Mrg	0.00	—	0.01	Dec 23, 2013	Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.
CVE-2013-4404	Red Hat Enterprise Mrg	0.00	—	0.02	Dec 23, 2013	cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended role restrictions and obtain sensitive information or perform privileged operations via unspecified vectors.
CVE-2013-2629	Leed Leed (Light Feed)	0.00	—	0.01	Dec 23, 2013	Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm, (2) importFeed, (3) addFavorite, or (4) removeFavorite actions in action.php.
CVE-2013-5973	VMware Esx	0.00	—	0.00	Dec 23, 2013	VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator role for a vCenter Server Add Existing Disk action with a (1) -flat, (2) -rdm, or (3) -rdmp filename.
CVE-2013-6745	IBM ISAM ESSO	0.00	—	0.01	Dec 22, 2013	Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVE-2013-6735	IBM Websphere Portal	0.00	—	0.04	Dec 22, 2013	IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information…
CVE-2013-6723	IBM Websphere Portal	0.00	—	0.02	Dec 22, 2013	IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager (WCM) navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors.
CVE-2013-6328	IBM Websphere Portal	0.00	—	0.01	Dec 22, 2013	Cross-site scripting (XSS) vulnerability in the Web Content Manager (WCM) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script…
CVE-2013-6316	IBM Websphere Portal	0.00	—	0.01	Dec 22, 2013	IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by…
CVE-2013-5421	IBM Security Access Manager For Enterprise Single Sign On	0.00	—	0.01	Dec 22, 2013	Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVE-2013-4012	IBM Websphere Portal	0.00	—	0.01	Dec 22, 2013	IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF09, when Content Template Catalog 4.0 is used, does not require administrative privileges for Portal Application Archive (PAA) file installation, which allows remote authenticated users to modify data or cause a denial of service via…
CVE-2013-3705	Novell Client	0.00	—	0.00	Dec 22, 2013	The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL.
CVE-2013-6978	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.02	Dec 21, 2013	The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249.
CVE-2013-6196	Microfocus Autonomy Ultraseek	0.00	—	0.02	Dec 21, 2013	Cross-site scripting (XSS) vulnerability in HP Autonomy Ultraseek 5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-5413	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation.
CVE-2013-5411	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors.
CVE-2013-5409	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2013-5407	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection"…
CVE-2013-5406	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, leading to improper interaction with the Windows MHTML…
CVE-2013-5405	IBM Sterling B2b Integrator	0.00	—	0.01	Dec 21, 2013	Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
CVE-2013-4070	IBM Spss Collaboration And Deployment Services	0.00	—	0.01	Dec 21, 2013	The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors.
CVE-2013-4069	IBM Spss Collaboration And Deployment Services	0.00	—	0.01	Dec 21, 2013	The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity…
CVE-2013-4065	IBM Lotus Domino	0.00	—	0.01	Dec 21, 2013	Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP.
CVE-2013-4064	IBM Lotus Domino	0.00	—	0.01	Dec 21, 2013	Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN9ARMFA.

CVE-2013-4554Dec 24, 2013
Xen
Xen
risk 0.00cvss —epss 0.01
Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
CVE-2013-4553Dec 24, 2013
Xen
Xen
risk 0.00cvss —epss 0.01
The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).
CVE-2013-4452Dec 24, 2013
Red Hat
Jboss Operations Network
risk 0.00cvss —epss 0.00
Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.
CVE-2013-4358Dec 24, 2013
FFmpeg
Ffmpeg
risk 0.00cvss —epss 0.01
libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data.
CVE-2011-5268Dec 24, 2013
Duckcorp
Bip
risk 0.00cvss —epss 0.01
connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550. NOTE: this issue was SPLIT from…
CVE-2013-6795Dec 24, 2013
Rackspace
Openstack Windows Guest Agent
risk 0.00cvss —epss 0.05
The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service…
CVE-2013-6403Dec 24, 2013
OwnCloud
Owncloud
risk 0.00cvss —epss 0.02
The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB.
CVE-2013-4550Dec 24, 2013
Duckcorp
Bip
risk 0.00cvss —epss 0.02
Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed…
CVE-2013-7102Dec 23, 2013
Optimizepress
Optimizepress
risk 0.04cvss —epss 0.15
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file…
CVE-2013-7081Dec 23, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.01
The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
CVE-2013-7080Dec 23, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.01
The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted…
CVE-2013-7079Dec 23, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.01
Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-7075Dec 23, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.01
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified…
CVE-2013-7073Dec 23, 2013
TYPO3
Typo3
risk 0.00cvss —epss 0.01
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
CVE-2013-7049Dec 23, 2013
Znc Msvc
znc-msvc
risk 0.00cvss —epss 0.02
Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT message.
CVE-2013-4424Dec 23, 2013
Red Hat
Jboss Portal
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-3709Dec 23, 2013
Novell
Suse Lifecycle Management Server
risk 0.00cvss —epss 0.00
WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
CVE-2013-6979Dec 23, 2013
Cisco Systems, Inc.
iOS Xe
risk 0.00cvss —epss 0.04
The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, aka Bug ID…
CVE-2013-6890Dec 23, 2013
Denyhosts
Denyhosts
risk 0.04cvss —epss 0.09
denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.
CVE-2013-6449Dec 23, 2013
OpenSSL Project
OpenSSL
risk 0.02cvss —epss 0.21
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
CVE-2013-6439Dec 23, 2013
Red Hat
Subscription Asset Manager
risk 0.00cvss —epss 0.02
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
CVE-2013-6422Dec 23, 2013
Curl
Libcurl
risk 0.00cvss —epss 0.03
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct…
CVE-2013-5420Dec 23, 2013
IBM
Security Access Manager For Enterprise Single Sign On
risk 0.00cvss —epss 0.01
The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to read log files by leveraging helpdesk privileges for a direct request.
CVE-2013-4549Dec 23, 2013
Qt
Qt
risk 0.00cvss —epss 0.03
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
CVE-2013-4461Dec 23, 2013
Red Hat
Enterprise Mrg
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator."
CVE-2013-4414Dec 23, 2013
Red Hat
Enterprise Mrg
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.
CVE-2013-4405Dec 23, 2013
Red Hat
Enterprise Mrg
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.
CVE-2013-4404Dec 23, 2013
Red Hat
Enterprise Mrg
risk 0.00cvss —epss 0.02
cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended role restrictions and obtain sensitive information or perform privileged operations via unspecified vectors.
CVE-2013-2629Dec 23, 2013
Leed
Leed (Light Feed)
risk 0.00cvss —epss 0.01
Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm, (2) importFeed, (3) addFavorite, or (4) removeFavorite actions in action.php.
CVE-2013-5973Dec 23, 2013
VMware
Esx
risk 0.00cvss —epss 0.00
VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator role for a vCenter Server Add Existing Disk action with a (1) -flat, (2) -rdm, or (3) -rdmp filename.
CVE-2013-6745Dec 22, 2013
IBM
ISAM ESSO
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVE-2013-6735Dec 22, 2013
IBM
Websphere Portal
risk 0.00cvss —epss 0.04
IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information…
CVE-2013-6723Dec 22, 2013
IBM
Websphere Portal
risk 0.00cvss —epss 0.02
IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager (WCM) navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors.
CVE-2013-6328Dec 22, 2013
IBM
Websphere Portal
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Web Content Manager (WCM) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script…
CVE-2013-6316Dec 22, 2013
IBM
Websphere Portal
risk 0.00cvss —epss 0.01
IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by…
CVE-2013-5421Dec 22, 2013
IBM
Security Access Manager For Enterprise Single Sign On
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form.
CVE-2013-4012Dec 22, 2013
IBM
Websphere Portal
risk 0.00cvss —epss 0.01
IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF09, when Content Template Catalog 4.0 is used, does not require administrative privileges for Portal Application Archive (PAA) file installation, which allows remote authenticated users to modify data or cause a denial of service via…
CVE-2013-3705Dec 22, 2013
Novell
Client
risk 0.00cvss —epss 0.00
The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL.
CVE-2013-6978Dec 21, 2013
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.02
The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249.
CVE-2013-6196Dec 21, 2013
Microfocus
Autonomy Ultraseek
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in HP Autonomy Ultraseek 5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-5413Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation.
CVE-2013-5411Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors.
CVE-2013-5409Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2013-5407Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection"…
CVE-2013-5406Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, leading to improper interaction with the Windows MHTML…
CVE-2013-5405Dec 21, 2013
IBM
Sterling B2b Integrator
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
CVE-2013-4070Dec 21, 2013
IBM
Spss Collaboration And Deployment Services
risk 0.00cvss —epss 0.01
The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors.
CVE-2013-4069Dec 21, 2013
IBM
Spss Collaboration And Deployment Services
risk 0.00cvss —epss 0.01
The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity…
CVE-2013-4065Dec 21, 2013
IBM
Lotus Domino
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP.
CVE-2013-4064Dec 21, 2013
IBM
Lotus Domino
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN9ARMFA.