Skip to content
OpenAdvisories

Archive

April 2013

Vulnerabilities first published in this month (UTC), newest first.

← March 2013 2013 / April May 2013 →
  1. 14
  2. 26
  3. 319
  4. 414
  5. 58
  6. 6 
  7. 72
  8. 87
  9. 931
  10. 1015
  11. 1116
  12. 1210
  13. 132
  14. 14 
  15. 15 
  16. 1614
  17. 17152
  18. 1814
  19. 197
  20. 20 
  21. 213
  22. 2222
  23. 235
  24. 2416
  25. 2528
  26. 2610
  27. 274
  28. 283
  29. 2915
  30. 303
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium —
    CVE-2013-0233 Public exploit EPSS 14%

    Devise does not properly perform type conversion when performing database queries

    Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incor…

    devise ruby-devise Debian RubyGems
  • Medium —
    CVE-2013-3060

    Improper Authentication in Apache ActiveMQ

    The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

    org.apache.activemq:activemq-client Maven
  • Medium —
    CVE-2012-6092

    Cross-site Scripting in Apache ActiveMQ

    Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Mark…

    org.apache.activemq:activemq-core Maven
  • Medium —
    CVE-2012-6551

    Apache ActiveMQ default configuration subject to denial of service

    The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.

    org.apache.activemq:apache-activemq org.apache.activemq:activemq-web-demo Maven
  • Medium —
    CVE-2013-0282

    OpenStack Keystone allows context-dependent attackers to bypass access restrictions

    OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restr…

    keystone keystone Debian PyPI
  • Medium 6.5
    CVE-2013-0270

    Keystone: openstack keystone: denial of service via large http request with long tenant name

    A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU a…

    Red Hat Red Hat OpenStack Platform 13 (Queens) Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Debian PyPI
  • Medium 6.1
    CVE-2013-1815

    Packstack: red hat openstack: packstack: unauthorized system modification via insecure answer file creation

    A flaw was found in PackStack. This vulnerability allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creation could lead to una…

    Red Hat OpenStack Folsom for RHEL 6 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Red Hat OpenStack Platform 4 Linux
  • Medium —
    CVE-2013-1821

    Ruby vulnerable to denial of service

    lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

    org.jruby:jruby Maven
  • Medium —
    CVE-2013-0284

    newrelic_rpm Gem Discloses Sensitive Information

    Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing t…

    newrelic_rpm RubyGems
  • Medium —
    CVE-2012-6134

    omniauth-oauth2 Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

    omniauth-oauth2 RubyGems
  • Medium —
    CVE-2013-1665

    XML External Entity (XXE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an ent…

    python-django django keystone Debian PyPI
  • Medium —
    CVE-2013-1664

    XML Entity Expansion (XEE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (r…

    django nova keystone cinder Debian PyPI
  • Medium —
    CVE-2013-1911

    ldoce Gem Arbitrary Command Execution

    lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.

    ldoce RubyGems