Archive
April 2013
Vulnerabilities first published in this month (UTC), newest first.
430 results · Feed
-
Unscored —
Buffer overflow in the vsflex7l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execu…
-
Unscored —
Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote atta…
-
Unscored —
Multiple buffer overflows in the Vsflex8l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allow remote attackers…
-
Unscored —
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a craf…
-
Unscored —
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sendi…
-
Unscored —
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or l…
-
Unscored —
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebas…
-
Unscored —
The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Dire…
-
Unscored —
Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4…
-
Unscored —
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architecture…
-
Unscored —CVE-2013-3301 Public exploit
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointe…
-
Unscored —
Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users…
-
Unscored —
The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list e…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Domain Manager allows rem…
-
Unscored —
Cross-site scripting (XSS) vulnerability in a Flash component in Cisco Unified Computing System (UCS) Central allows re…
-
Unscored —
Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory c…
-
Unscored —
SensorApp in Cisco Intrusion Prevention System (IPS) allows local users to cause a denial of service (Regex hardware jo…
-
Unscored —
The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a de…
-
Unscored —
The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in HP Managed Printing Administration (MPA) before 2.7.0 allows remote attacke…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Communities component in IBM Connections 4.5 allows remote attackers to…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1…
-
Unscored —
Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001…
-
Unscored —
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1p…
-
Unscored —
Multiple untrusted search path vulnerabilities in Global Mapper 14.1.0 allow local users to gain privileges via a Troja…
-
Unscored —
The Yahoo! Browser application before 1.4.3 for Android allows remote attackers to spoof the address bar via a crafted …
-
Unscored —
The jigbrowser+ application before 1.6.4 for Android does not properly open windows, which allows remote attackers to s…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remot…
-
Unscored —
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows local users to gain privileges…
-
High 8.5CVE-2013-3239 Public exploit
phpMyAdmin Remote Code Execution
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file a…
-
Unscored —
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via …
-
Unscored —CVE-2013-3241 Public exploit
export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the c…
-
Unscored —CVE-2013-3240 Public exploit
Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated …
-
Medium —
Devise does not properly perform type conversion when performing database queries
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incor…
-
High —
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of serv…
-
Unscored —
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) …
-
Unscored —
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Troj…
-
Critical —
Shell Metacharacter Injection in kelredd-pruview
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.