Skip to content
OpenAdvisories

Archive

8 March 2013

Vulnerabilities first published on this day (UTC), newest first.

← February 2013 2013 / March /8 April 2013 →
  1. 119
  2. 28
  3. 33
  4. 418
  5. 52
  6. 69
  7. 722
  8. 816
  9. 918
  10. 10 
  11. 1121
  12. 1232
  13. 1327
  14. 1419
  15. 1515
  16. 16 
  17. 17 
  18. 183
  19. 1922
  20. 2029
  21. 2127
  22. 2220
  23. 23 
  24. 24 
  25. 258
  26. 267
  27. 2737
  28. 2835
  29. 2921
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

16 results · Feed

  • Medium —
    CVE-2011-4969 EPSS 19%

    jQuery vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

    jquery-rails jquery org.webjars.npm:jquery jQuery Azure Linux npm Maven NuGet RubyGems
  • Unscored —
    CVE-2011-2504

    Untrusted search path vulnerability in x11perfcomp in XFree86 x11perf before 1.5.4 allows local users to gain privilege…

    x11-apps Debian
  • Unscored —
    CVE-2013-0249 Public exploit EPSS 22%

    Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl …

    curl Debian
  • Unscored —
    CVE-2013-1050

    The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in…

  • Unscored —
    CVE-2011-3201

    GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter…

    evolution Debian
  • High 8.8
    CVE-2013-0261

    Packstack: packstack: arbitrary file overwrite via symlink attack

    A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system …

    Red Hat OpenStack Folsom for RHEL 6 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Red Hat OpenStack Platform 4 Linux
  • Medium 5.5
    CVE-2013-0266

    Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.

    A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit …

    Red Hat OpenStack Folsom for RHEL 6 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Red Hat OpenStack Platform 4 Linux
  • Unscored —
    CVE-2013-0308

    The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subje…

  • Unscored —
    CVE-2013-0401 EPSS 10%

    The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.…

  • Unscored —
    CVE-2013-0402

    Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier an…

  • Medium —
    CVE-2013-1656

    Spree Improper Input Validation vulnerability

    Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the …

    spree RubyGems
  • Unscored —
    CVE-2013-1491 Public exploit EPSS 16%

    The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Up…

  • Unscored —
    CVE-2013-1488 Public exploit EPSS 87%

    The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows rem…

  • Unscored —
    CVE-2013-1762

    stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly pe…

    stunnel4 Debian
  • Medium —
    CVE-2013-2506

    spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

    app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

    spree_auth_devise RubyGems
  • Unscored —
    CVE-2012-4066

    The internal message protocol for Walrus in Eucalyptus 3.2.0 and earlier does not require signatures for unspecified re…