Skip to content
OpenAdvisories

Archive

19 March 2013

Vulnerabilities first published on this day (UTC), newest first.

← February 2013 2013 / March /19 April 2013 →
  1. 119
  2. 28
  3. 33
  4. 418
  5. 52
  6. 69
  7. 722
  8. 816
  9. 918
  10. 10 
  11. 1121
  12. 1232
  13. 1327
  14. 1419
  15. 1515
  16. 16 
  17. 17 
  18. 183
  19. 1922
  20. 2029
  21. 2127
  22. 2220
  23. 23 
  24. 24 
  25. 258
  26. 267
  27. 2737
  28. 2835
  29. 2921
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

22 results · Feed

  • Medium —
    CVE-2013-1856

    activesupport Improper Input Validation vulnerability

    The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML p…

    activesupport RubyGems
  • Medium —
    CVE-2013-1855

    actionpack Cross-site Scripting vulnerability

    The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2013-1857

    actionpack Cross-site Scripting vulnerability

    The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URL…

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2013-1854

    Active Record Improper Input Validation

    The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a wher…

    rails activerecord Debian RubyGems
  • Unscored —
    CVE-2013-0505

    IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before F…

  • Unscored —
    CVE-2013-0717

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N,…

  • Unscored —
    CVE-2013-0506

    Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before…

  • Unscored —
    CVE-2013-1863

    Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on no…

  • Unscored —
    CVE-2013-0251

    Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause …

    latd Debian
  • Medium —
    CVE-2013-0329

    Jenkins Cross-Site Request Forgery vulnerability

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2013-0205

    Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and …

  • Unscored —
    CVE-2013-0206

    Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Dru…

  • Unscored —
    CVE-2013-0224

    The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arb…

  • Medium —
    CVE-2013-0330

    Jenkins allows Remote Users to Build Arbitrary Jobs

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2013-0225

    Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x…

  • Unscored —
    CVE-2013-0227

    Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote…

  • Unscored —
    CVE-2013-0226

    The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which…

  • Unscored —
    CVE-2013-0207

    Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows re…

  • Medium —
    CVE-2013-0331

    Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload

    Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0327

    Jenkins Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0328

    Jenkins subject to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2013-2263

    Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers t…