20 March 2013

29 results · Feed

• High —
  CVE-2013-1875

  Shell command injection in command_wrap

  command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.

  command_wrap RubyGems
  Mar 20, 2013
• High —
  CVE-2013-2615

  fastreader Gem for Ruby URI Handling Arbitrary Command Injection

  lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

  fastreader RubyGems
  Mar 20, 2013
• High —
  CVE-2013-2617

  Curl Gem insufficient URL escaping command injection

  lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

  curl RubyGems
  Mar 20, 2013
• High —
  CVE-2013-2616

  MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

  lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

  mini_magick RubyGems
  Mar 20, 2013
• Unscored —
  CVE-2013-0714

  IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or c…

  Mar 20, 2013
• Unscored —
  CVE-2013-0716

  The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash…

  Mar 20, 2013
• Unscored —
  CVE-2013-0713

  IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of…

  Mar 20, 2013
• Unscored —
  CVE-2013-0711

  IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (…

  Mar 20, 2013
• Unscored —
  CVE-2013-0715

  The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of servi…

  Mar 20, 2013
• Unscored —
  CVE-2013-0712

  IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of…

  Mar 20, 2013
• Unscored —
  CVE-2013-1750

  Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remot…

  Mar 20, 2013
• Unscored —
  CVE-2013-1640

  The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, a…

  puppet Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-1653

  Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before …

  puppet Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-1652

  Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before …

  puppet Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-1654

  Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiat…

  puppet Debian
  Mar 20, 2013
• High —
  CVE-2013-1655

  Puppet Improper Input Validation vulnerability

  Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

  puppet puppet Debian RubyGems
  Mar 20, 2013
• Unscored —
  CVE-2013-2275

  The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x b…

  puppet Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-2274

  Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitr…

  puppet Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-0232 Public exploit EPSS 48%

  includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitr…

  zoneminder Debian
  Mar 20, 2013
• Unscored —
  CVE-2013-0332 Public exploit EPSS 10%

  Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrar…

  zoneminder Debian
  Mar 20, 2013
• Medium 5.3
  CVE-2013-1843

  TYPO3 Open redirect vulnerability in the Access tracking mechanism

  Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspec…

  typo3/cms-core Packagist
  Mar 20, 2013
• Unscored —
  CVE-2013-1766

  libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these file…

  libvirt Debian
  Mar 20, 2013
• High 7.4
  CVE-2013-1842

  TYPO3 SQL injection vulnerability in the Extbase Framework

  SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object …

  typo3/cms-core Packagist
  Mar 20, 2013
• Unscored —
  CVE-2013-0981

  The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.…

  Mar 20, 2013
• Unscored —
  CVE-2013-0977

  dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O …

  Mar 20, 2013
• Unscored —
  CVE-2013-0980

  The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physic…

  Mar 20, 2013
• Unscored —
  CVE-2013-0979

  lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting ste…

  Mar 20, 2013
• Unscored —
  CVE-2013-0978

  The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that i…

  Mar 20, 2013
• Unscored —
  CVE-2012-5938

  The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect p…

  Mar 20, 2013