Archive
March 2013
Vulnerabilities first published in this month (UTC), newest first.
438 results · Feed
-
Unscored —
The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows re…
-
Medium —
Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
-
Medium —
Jenkins Cross-Site Request Forgery vulnerability
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
-
Medium —
Jenkins subject to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers t…
-
Unscored —
asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files vi…
-
Unscored —
The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have…
-
Unscored —
Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM)…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.…
-
Unscored —
The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.…
-
Unscored —
The Web API in the Statistics Server in TIBCO Spotfire Statistics Services 3.3.x before 3.3.1, 4.5.x before 4.5.1, and …
-
Unscored —
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Wind…
-
Unscored —
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attac…
-
Unscored —
WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (mem…
-
Medium 6.8
Incorrect Default Permissions in Apache Commons FileUpload
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
-
Unscored —
Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a …
-
Unscored —
Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, whi…
-
Unscored —
Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which a…
-
Unscored —
WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (mem…
-
Unscored —
Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary cod…
-
Unscored —
IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial…
-
Unscored —
The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle igno…
-
Unscored —CVE-2013-2560 Public exploit
Directory traversal vulnerability in the web interface on Foscam devices with firmware before 11.37.2.49 allows remote …
-
Medium 5.9
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for…
-
Unscored —
The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library funct…
-
Unscored —
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Li…
-
Unscored —
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Li…
-
Unscored —
The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a cert…
-
Unscored —
The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users …
-
Unscored —
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consisten…
-
Unscored —
The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allo…
-
Unscored —
The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain struc…
-
Unscored —
The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a ce…
-
Unscored —
The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structur…
-
Unscored —
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to…
-
Unscored —
The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, whi…
-
Unscored —
The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure mem…
-
Unscored —
The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain s…
-
Unscored —
The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library funct…