Archive
March 2013
Vulnerabilities first published in this month (UTC), newest first.
438 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows rem…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drup…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the admin view in the Search API (search_api) module 7.x-1.x before 7.x-1.4…
-
Unscored —
The COBIME application before 0.9.4 for Android uses weak permissions for unspecified files, which allows attackers to …
-
Unscored —
The Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files, which allows attacker…
-
Unscored —
The ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for unspecified files, which …
-
Unscored —
The FlickWnn (aka OpenWnn/Flick support) application 2.02 and earlier for Android uses weak permissions for unspecified…
-
Unscored —
Memory leak in the HTTP server in IBM Domino 8.5.x allows remote attackers to cause a denial of service (memory consump…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x …
-
Unscored —
Cross-site scripting (XSS) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows …
-
Unscored —
The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging kn…
-
Unscored —
The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web scrip…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM iNotes 8.5.x before 8.5.3 FP4 allows user-assisted remote attackers to …
-
High 7.8
Multiple unquoted Windows search path vulnerabilities in the (1) File Collector and (2) File PlaceHolder services in Sy…
-
Unscored —
Directory traversal vulnerability in the Management Console on the Symantec NetBackup (NBU) appliance 2.0.x allows remo…
-
Unscored —
The traffic engineering (TE) processing subsystem in Cisco IOS XR allows remote attackers to cause a denial of service …
-
Unscored —
The XML parser in the Cisco Jabber IM application for Android allows remote authenticated users to cause a denial of se…
-
Medium —
Moodle includes the WebDAV password in the configuration form
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by …
-
Medium —
Moodle does not properly manage privileges for WebDAV repositories
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by lever…
-
Low —
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted fi…
-
Low —
Moodle's login_as feature leaks information from external repositories
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
-
Medium —
Moodle reveals absolute path in exception message
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
-
Medium —
Moodle allows remote authenticated users to reassign notes
notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
-
Unscored —
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displayi…
-
Medium —
Moodle does not enforce the forceloginforprofiles setting
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest rol…
-
High 7.6
Openstack nova: vnc proxy can connect to the wrong vm
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
-
Medium 6.5
Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the …
-
Medium 5.3
OpenStack Keystone Improper Authentication vulnerability
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
-
Medium 6.5
OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large …
-
Unscored —CVE-2013-2501 Public exploit
Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attacke…
-
Unscored —
ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Aja…
-
Unscored —
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Aja…
-
Unscored —
The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_re…
-
Unscored —
Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.…
-
Unscored —
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a cer…
-
Unscored —
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error…
-
Unscored —
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time…