25 April 2013

28 results · Feed

• Medium —
  CVE-2013-0233 Public exploit EPSS 15%

  Devise does not properly perform type conversion when performing database queries

  Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incor…

  devise ruby-devise Debian RubyGems
  Apr 25, 2013
• High —
  CVE-2013-0175

  Improper Input Validation in multi_xml

  multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of serv…

  multi_xml RubyGems
  Apr 25, 2013
• Unscored —
  CVE-2013-0338

  libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) …

  libxml2 Debian
  Apr 25, 2013
• Unscored —
  CVE-2013-1949

  Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Troj…

  Apr 25, 2013
• Critical —
  CVE-2013-1947

  Shell Metacharacter Injection in kelredd-pruview

  kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.

  kelredd-pruview RubyGems
  Apr 25, 2013
• Critical —
  CVE-2013-1948

  md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

  converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

  md2pdf RubyGems
  Apr 25, 2013
• High —
  CVE-2013-1933

  Karteek Docsplit vulnerable to OS Command Injection

  The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.

  karteek-docsplit RubyGems
  Apr 25, 2013
• Unscored —
  CVE-2013-1915

  ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or ca…

  modsecurity-apache Debian
  Apr 25, 2013
• Unscored —
  CVE-2013-1969

  Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent atta…

  Apr 25, 2013
• Unscored —
  CVE-2012-4464

  Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level…

  Apr 25, 2013
• Unscored —
  CVE-2012-4466

  Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent …

  Apr 25, 2013
• Unscored —
  CVE-2013-1215

  The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local u…

  Apr 25, 2013
• Unscored —
  CVE-2013-2767

  Unspecified vulnerability in Citrix NetScaler Access Gateway Enterprise Edition (AGEE) before 9.3.62.4 and 10.x through…

  Apr 25, 2013
• Unscored —
  CVE-2013-2696

  Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows re…

  Apr 25, 2013
• Unscored —
  CVE-2013-1178

  Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x…

  Apr 25, 2013
• Unscored —
  CVE-2013-1179

  Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices …

  Apr 25, 2013
• Unscored —
  CVE-2013-1182

  The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 …

  Apr 25, 2013
• Unscored —
  CVE-2013-1183

  Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco…

  Apr 25, 2013
• Unscored —
  CVE-2013-1186

  Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM aut…

  Apr 25, 2013
• Unscored —
  CVE-2013-1184

  The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1…

  Apr 25, 2013
• Unscored —
  CVE-2013-1181

  Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unifie…

  Apr 25, 2013
• Unscored —
  CVE-2013-1192

  The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus…

  Apr 25, 2013
• Unscored —
  CVE-2013-1180

  Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x befor…

  Apr 25, 2013
• Unscored —
  CVE-2013-1185

  The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows re…

  Apr 25, 2013
• Unscored —
  CVE-2013-3269

  Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attack…

  Apr 25, 2013
• Unscored —
  CVE-2013-2305

  Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before…

  Apr 25, 2013
• Unscored —
  CVE-2013-0728

  Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Ex…

  Apr 25, 2013
• Unscored —
  CVE-2013-3055

  Lexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789, which allows remote attacker…

  Apr 25, 2013