Skip to content
OpenAdvisories

Archive

19 March 2013

Vulnerabilities first published on this day (UTC), newest first.

← February 2013 2013 / March /19 April 2013 →
  1. 119
  2. 28
  3. 33
  4. 418
  5. 52
  6. 69
  7. 722
  8. 816
  9. 918
  10. 10 
  11. 1121
  12. 1232
  13. 1327
  14. 1419
  15. 1515
  16. 16 
  17. 17 
  18. 183
  19. 1922
  20. 2029
  21. 2127
  22. 2220
  23. 23 
  24. 24 
  25. 258
  26. 267
  27. 2737
  28. 2835
  29. 2921
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium —
    CVE-2013-1856

    activesupport Improper Input Validation vulnerability

    The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML p…

    activesupport RubyGems
  • Medium —
    CVE-2013-1855

    actionpack Cross-site Scripting vulnerability

    The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2013-1857

    actionpack Cross-site Scripting vulnerability

    The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URL…

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2013-1854

    Active Record Improper Input Validation

    The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a wher…

    rails activerecord Debian RubyGems
  • Medium —
    CVE-2013-0329

    Jenkins Cross-Site Request Forgery vulnerability

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0330

    Jenkins allows Remote Users to Build Arbitrary Jobs

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0331

    Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload

    Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0327

    Jenkins Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0328

    Jenkins subject to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven