Skip to content
OpenAdvisories

Archive

July 2013

Vulnerabilities first published in this month (UTC), newest first.

← June 2013 2013 / July August 2013 →
  1. 113
  2. 29
  3. 324
  4. 411
  5. 5 
  6. 65
  7. 7 
  8. 822
  9. 910
  10. 1071
  11. 1110
  12. 128
  13. 133
  14. 14 
  15. 156
  16. 1613
  17. 1777
  18. 1840
  19. 1913
  20. 20 
  21. 212
  22. 225
  23. 2311
  24. 247
  25. 254
  26. 2624
  27. 27 
  28. 288
  29. 2932
  30. 3015
  31. 3143
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.5
    CVE-2013-2056

    Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass

    A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication proces…

    Red Hat Red Hat Satellite 6 Red Hat Network Satellite Server v 5.4 Red Hat Network Satellite Server v 5.5
  • High —
    CVE-2013-4002 Public exploit EPSS 25%

    Missing XML Validation in Apache Xerces2

    XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u6…

    xerces:xercesImpl Maven
  • High —
    CVE-2013-2165 Public exploit EPSS 13%

    Remote code execution due to insecure deserialization

    ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat…

    org.richfaces:richfaces Maven
  • High —
    CVE-2013-2135 EPSS 14%

    Arbitrary code execution in Apache Struts 2

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High —
    CVE-2013-2134 Public exploit EPSS 70%

    Arbitrary code execution in Apache Struts 2

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High —
    CVE-2013-1768

    Deserialization of Untrusted Data in Apache OpenJPA

    The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attac…

    org.apache.openjpa:openjpa openjpa Debian Maven
  • High —
    CVE-2013-1777

    Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

    The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbit…

    org.apache.geronimo.framework:geronimo-jmx-remoting Maven
  • High —
    CVE-2013-1966 Public exploit EPSS 74%

    Arbitrary code execution in Apache Struts

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High —
    CVE-2013-1965 Public exploit Scanner template EPSS 94%

    Improper Control of Generation of Code in Apache Struts

    Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

    org.apache.struts:struts2-core Maven
  • High 8.1
    CVE-2013-2115 Public exploit EPSS 75%

    Code injection in Apache Struts

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-…

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High 8.4
    CVE-2013-1340

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, …

  • High 8.8
    CVE-2013-3163 Exploited Public exploit EPSS 71%

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service…

    KEV Mar 30, 2023
  • High 7.8
    CVE-2013-3129 EPSS 32%

    Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mo…

  • High —
    CVE-2013-4748

    News system (news) extension for TYPO3 vulnerable to SQL Injection

    SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    georgringer/news Packagist