Skip to content
OpenAdvisories

Archive

8 March 2013

Vulnerabilities first published on this day (UTC), newest first.

← February 2013 2013 / March /8 April 2013 →
  1. 119
  2. 28
  3. 33
  4. 418
  5. 52
  6. 69
  7. 722
  8. 816
  9. 918
  10. 10 
  11. 1121
  12. 1232
  13. 1327
  14. 1419
  15. 1515
  16. 16 
  17. 17 
  18. 183
  19. 1922
  20. 2029
  21. 2127
  22. 2220
  23. 23 
  24. 24 
  25. 258
  26. 267
  27. 2737
  28. 2835
  29. 2921
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    CVE-2011-4969 EPSS 19%

    jQuery vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

    jquery-rails org.webjars.npm:jquery jQuery jquery Azure Linux npm Maven NuGet RubyGems
  • Medium 5.5
    CVE-2013-0266

    Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.

    A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit …

    Red Hat OpenStack Folsom for RHEL 6 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Red Hat OpenStack Platform 4 Linux
  • Medium —
    CVE-2013-1656

    Spree Improper Input Validation vulnerability

    Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the …

    spree RubyGems
  • Medium —
    CVE-2013-2506

    spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

    app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

    spree_auth_devise RubyGems