CVEs

387,028 total · page 6637 of 7,741

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2013-0483	IBM Ims Enterprise Suite	0.00	—	0.01	Apr 5, 2013	The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2013-0470	IBM Netezza Performance Portal	0.00	—	0.01	Apr 5, 2013	HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files.
CVE-2013-2302	Transware Active\! Mail	0.00	—	0.00	Apr 4, 2013	TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitrary users by leveraging shell access, as demonstrated by a TELNET or SSH session to the server.
CVE-2013-0128	Tigertext Tigertext	0.00	—	0.01	Apr 4, 2013	The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an…
CVE-2013-0125	—	0.03	—	0.02	Apr 4, 2013	Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.
CVE-2013-1903	PostgreSQL PostgreSQL	0.00	—	0.02	Apr 4, 2013	PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack…
CVE-2013-1902	PostgreSQL PostgreSQL	0.00	—	0.02	Apr 4, 2013	PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac…
CVE-2013-1901	PostgreSQL PostgreSQL	0.00	—	0.03	Apr 4, 2013	PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
CVE-2013-1900	PostgreSQL PostgreSQL	0.00	—	0.05	Apr 4, 2013	PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto…
CVE-2013-1899	PostgreSQL PostgreSQL	0.07	—	0.54	Apr 4, 2013	Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary…
CVE-2012-4710	Invensys Wonderware Win XML Exporter	0.00	—	0.02	Apr 4, 2013	Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference.
CVE-2013-2763	Schneider Electric M340	0.00	—	0.02	Apr 4, 2013	The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors. NOTE: the vendor reportedly disputes this issue because it "could not be duplicated" and "an attacker could not remotely exploit this…
CVE-2013-2762	Schneider Electric Magelis XBT HMI controller	0.00	—	0.02	Apr 4, 2013	The Schneider Electric Magelis XBT HMI controller has a default password for authentication of configuration uploads, which makes it easier for remote attackers to bypass intended access restrictions via crafted configuration data.
CVE-2013-2761	Schneider Electric M340 BMXNOE01xx	0.00	—	0.01	Apr 4, 2013	The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as demonstrated by the FileZilla FTP client.
CVE-2013-0664	Schneider Electric FactoryCast	0.00	—	0.04	Apr 4, 2013	The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP…
CVE-2013-0663	Schneider Electric Premium	0.03	—	0.06	Apr 4, 2013	Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the…
CVE-2013-0800	Pixman Pixman	0.00	—	0.04	Apr 3, 2013	Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and…
CVE-2013-0799	Mozilla Corporation Firefox	0.00	—	0.00	Apr 3, 2013	Buffer overflow in the Mozilla Maintenance Service in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, and Thunderbird ESR 17.x before 17.0.5 on Windows allows local users to gain privileges via crafted arguments.
CVE-2013-0798	Mozilla Corporation Firefox	0.00	—	0.01	Apr 3, 2013	Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which…
CVE-2013-0797	Mozilla Corporation Firefox	0.00	—	0.00	Apr 3, 2013	Untrusted search path vulnerability in the Mozilla Updater in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allows local users to gain privileges via a Trojan horse DLL file…
CVE-2013-0796	Mozilla Corporation Firefox	0.01	—	0.08	Apr 3, 2013	The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary…
CVE-2013-0795	Mozilla Corporation Firefox	0.00	—	0.03	Apr 3, 2013	The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which…
CVE-2013-0794	Mozilla Corporation Firefox	0.00	—	0.01	Apr 3, 2013	Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site.
CVE-2013-0793	Mozilla Corporation Firefox	0.00	—	0.02	Apr 3, 2013	Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site…
CVE-2013-0792	Mozilla Corporation Firefox	0.00	—	0.01	Apr 3, 2013	Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory…
CVE-2013-0791	Mozilla Corporation Firefox	0.00	—	0.05	Apr 3, 2013	The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote…
CVE-2013-0790	Mozilla Corporation Firefox	0.00	—	0.04	Apr 3, 2013	Unspecified vulnerability in the browser engine in Mozilla Firefox before 20.0 on Android allows remote attackers to cause a denial of service (stack memory corruption and application crash) or possibly execute arbitrary code via unknown vectors involving a plug-in.
CVE-2013-0789	Mozilla Corporation Firefox	0.00	—	0.04	Apr 3, 2013	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the…
CVE-2013-0788	Mozilla Corporation Firefox	0.00	—	0.05	Apr 3, 2013	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory…
CVE-2013-1911	Mark Burns Ldoce	0.00	—	0.02	Apr 3, 2013	lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
CVE-2013-1665	OpenStack Folsom	0.00	—	0.05	Apr 3, 2013	The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka…
CVE-2013-1664	OpenStack Folsom	0.00	—	0.05	Apr 3, 2013	The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption…
CVE-2012-6129	Transmissionbt Transmission	0.00	—	0.05	Apr 3, 2013	Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
CVE-2012-4546	Red Hat Enterprise Linux Server	0.00	—	0.01	Apr 3, 2013	The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and…
CVE-2012-1038	Juniper Networks Networks Mobility System Software	0.03	—	0.02	Apr 3, 2013	Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to…
CVE-2013-1823	Red Hat Subscription Asset Manager	0.00	—	0.02	Apr 2, 2013	Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVE-2012-6119	Candlepinproject Candlepin	0.00	—	0.00	Apr 2, 2013	Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
CVE-2013-2744	WordPress BackupBuddy	0.00	—	0.02	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVE-2013-2743	WordPress BackupBuddy	0.00	—	0.03	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVE-2013-2742	WordPress BackupBuddy	0.00	—	0.02	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
CVE-2013-2741	WordPress BackupBuddy	0.00	—	0.03	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct…
CVE-2013-1808	Zeroclipboard Project Zeroclipboard	0.00	—	0.07	Apr 2, 2013	Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id…
CVE-2013-1799	GNOME Foundation Gnome Online Accounts	0.00	—	0.01	Apr 2, 2013	Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by…
CVE-2013-0240	GNOME Foundation Gnome Online Accounts	0.00	—	0.01	Apr 2, 2013	Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as…
CVE-2012-6550	Zeroclipboard Project Zeroclipboard	0.00	—	0.05	Apr 2, 2013	Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
CVE-2013-1171	Cisco Systems, Inc. Connected Grid Network Management System	0.00	—	0.01	Apr 1, 2013	Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCue14517, CSCue38914,…
CVE-2013-1163	Cisco Systems, Inc. Connected Grid Network Management System	0.00	—	0.01	Apr 1, 2013	Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746.
CVE-2013-0502	IBM Infosphere Information Server	0.00	—	0.01	Apr 1, 2013	Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
CVE-2012-4861	IBM Infosphere Replication Server	0.00	—	0.01	Apr 1, 2013	The web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7 and 10.1 through 10.1.0.4 allows remote authenticated users to list directories via a direct request for a directory URL.
CVE-2013-0659	Siemens Foundation Cp 1604	0.00	—	0.06	Apr 1, 2013	The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.

CVE-2013-0483Apr 5, 2013
IBM
Ims Enterprise Suite
risk 0.00cvss —epss 0.01
The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2013-0470Apr 5, 2013
IBM
Netezza Performance Portal
risk 0.00cvss —epss 0.01
HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files.
CVE-2013-2302Apr 4, 2013
Transware
Active\! Mail
risk 0.00cvss —epss 0.00
TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitrary users by leveraging shell access, as demonstrated by a TELNET or SSH session to the server.
CVE-2013-0128Apr 4, 2013
Tigertext
Tigertext
risk 0.00cvss —epss 0.01
The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an…
CVE-2013-0125Apr 4, 2013
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.
CVE-2013-1903Apr 4, 2013
PostgreSQL
PostgreSQL
risk 0.00cvss —epss 0.02
PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack…
CVE-2013-1902Apr 4, 2013
PostgreSQL
PostgreSQL
risk 0.00cvss —epss 0.02
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac…
CVE-2013-1901Apr 4, 2013
PostgreSQL
PostgreSQL
risk 0.00cvss —epss 0.03
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
CVE-2013-1900Apr 4, 2013
PostgreSQL
PostgreSQL
risk 0.00cvss —epss 0.05
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto…
CVE-2013-1899Apr 4, 2013
PostgreSQL
PostgreSQL
risk 0.07cvss —epss 0.54
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary…
CVE-2012-4710Apr 4, 2013
Invensys
Wonderware Win XML Exporter
risk 0.00cvss —epss 0.02
Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference.
CVE-2013-2763Apr 4, 2013
Schneider Electric
M340
risk 0.00cvss —epss 0.02
The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors. NOTE: the vendor reportedly disputes this issue because it "could not be duplicated" and "an attacker could not remotely exploit this…
CVE-2013-2762Apr 4, 2013
Schneider Electric
Magelis XBT HMI controller
risk 0.00cvss —epss 0.02
The Schneider Electric Magelis XBT HMI controller has a default password for authentication of configuration uploads, which makes it easier for remote attackers to bypass intended access restrictions via crafted configuration data.
CVE-2013-2761Apr 4, 2013
Schneider Electric
M340 BMXNOE01xx
risk 0.00cvss —epss 0.01
The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as demonstrated by the FileZilla FTP client.
CVE-2013-0664Apr 4, 2013
Schneider Electric
FactoryCast
risk 0.00cvss —epss 0.04
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP…
CVE-2013-0663Apr 4, 2013
Schneider Electric
Premium
risk 0.03cvss —epss 0.06
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the…
CVE-2013-0800Apr 3, 2013
Pixman
Pixman
risk 0.00cvss —epss 0.04
Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and…
CVE-2013-0799Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.00
Buffer overflow in the Mozilla Maintenance Service in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, and Thunderbird ESR 17.x before 17.0.5 on Windows allows local users to gain privileges via crafted arguments.
CVE-2013-0798Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which…
CVE-2013-0797Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in the Mozilla Updater in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allows local users to gain privileges via a Trojan horse DLL file…
CVE-2013-0796Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.01cvss —epss 0.08
The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary…
CVE-2013-0795Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.03
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which…
CVE-2013-0794Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site.
CVE-2013-0793Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.02
Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site…
CVE-2013-0792Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory…
CVE-2013-0791Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote…
CVE-2013-0790Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the browser engine in Mozilla Firefox before 20.0 on Android allows remote attackers to cause a denial of service (stack memory corruption and application crash) or possibly execute arbitrary code via unknown vectors involving a plug-in.
CVE-2013-0789Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the…
CVE-2013-0788Apr 3, 2013
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory…
CVE-2013-1911Apr 3, 2013
Mark Burns
Ldoce
risk 0.00cvss —epss 0.02
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
CVE-2013-1665Apr 3, 2013
OpenStack
Folsom
risk 0.00cvss —epss 0.05
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka…
CVE-2013-1664Apr 3, 2013
OpenStack
Folsom
risk 0.00cvss —epss 0.05
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption…
CVE-2012-6129Apr 3, 2013
Transmissionbt
Transmission
risk 0.00cvss —epss 0.05
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
CVE-2012-4546Apr 3, 2013
Red Hat
Enterprise Linux Server
risk 0.00cvss —epss 0.01
The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and…
CVE-2012-1038Apr 3, 2013
Juniper Networks
Networks Mobility System Software
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to…
CVE-2013-1823Apr 2, 2013
Red Hat
Subscription Asset Manager
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVE-2012-6119Apr 2, 2013
Candlepinproject
Candlepin
risk 0.00cvss —epss 0.00
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
CVE-2013-2744Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.02
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVE-2013-2743Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.03
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVE-2013-2742Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.02
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
CVE-2013-2741Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.03
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct…
CVE-2013-1808Apr 2, 2013
Zeroclipboard Project
Zeroclipboard
risk 0.00cvss —epss 0.07
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id…
CVE-2013-1799Apr 2, 2013
GNOME Foundation
Gnome Online Accounts
risk 0.00cvss —epss 0.01
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by…
CVE-2013-0240Apr 2, 2013
GNOME Foundation
Gnome Online Accounts
risk 0.00cvss —epss 0.01
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as…
CVE-2012-6550Apr 2, 2013
Zeroclipboard Project
Zeroclipboard
risk 0.00cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
CVE-2013-1171Apr 1, 2013
Cisco Systems, Inc.
Connected Grid Network Management System
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCue14517, CSCue38914,…
CVE-2013-1163Apr 1, 2013
Cisco Systems, Inc.
Connected Grid Network Management System
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746.
CVE-2013-0502Apr 1, 2013
IBM
Infosphere Information Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
CVE-2012-4861Apr 1, 2013
IBM
Infosphere Replication Server
risk 0.00cvss —epss 0.01
The web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7 and 10.1 through 10.1.0.4 allows remote authenticated users to list directories via a direct request for a directory URL.
CVE-2013-0659Apr 1, 2013
Siemens Foundation
Cp 1604
risk 0.00cvss —epss 0.06
The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.