Skip to content
OpenAdvisories

Archive

February 2013

Vulnerabilities first published in this month (UTC), newest first.

← January 2013 2013 / February March 2013 →
  1. 11
  2. 251
  3. 319
  4. 41
  5. 510
  6. 615
  7. 72
  8. 821
  9. 9 
  10. 10 
  11. 111
  12. 1227
  13. 1379
  14. 149
  15. 1511
  16. 167
  17. 17 
  18. 1812
  19. 1918
  20. 2022
  21. 215
  22. 2210
  23. 2323
  24. 2434
  25. 251
  26. 262
  27. 2714
  28. 2810
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium —
    CVE-2012-6072

    Jenkins allows HTTP Injection and Response Splitting

    CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HT…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0212 Public exploit

    OpenStack Glance logs user name and password in cleartext

    store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote auth…

    glance glance Debian PyPI
  • Medium —
    CVE-2012-6531

    Zend Framework XEE Vulnerability

    (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity…

    zendframework/zendframework1 zend-framework Ubuntu Packagist
  • Medium —
    CVE-2012-6532

    Zend Framework XEE Vulnerability

    (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definitio…

    zendframework/zendframework1 zend-framework Ubuntu Packagist
  • Medium —
    CVE-2013-0276

    ActiveRecord vulnerable to modification of protected model attributes

    ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

    rails activerecord Debian RubyGems
  • Medium —
    CVE-2013-0263

    Rack arbitrary code execution via timing attack

    Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involvin…

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-0262

    Rack Vulnerable to Path Traversal

    rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remot…

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-1624

    Improper Input Validation in Bouncy Castle

    The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote att…

    bouncycastle org.bouncycastle:bcprov-jdk15on Debian Maven