Skip to content
OpenAdvisories

Archive

July 2013

Vulnerabilities first published in this month (UTC), newest first.

← June 2013 2013 / July August 2013 →
  1. 113
  2. 29
  3. 324
  4. 411
  5. 5 
  6. 65
  7. 7 
  8. 822
  9. 910
  10. 1071
  11. 1110
  12. 128
  13. 133
  14. 14 
  15. 156
  16. 1613
  17. 1777
  18. 1840
  19. 1913
  20. 20 
  21. 212
  22. 225
  23. 2311
  24. 247
  25. 254
  26. 2624
  27. 27 
  28. 288
  29. 2932
  30. 3015
  31. 3143
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.1
    CVE-2013-2209

    Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown

    Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.

    reviewboard PyPI
  • Medium —
    CVE-2013-4997

    phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (a…

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist
  • Medium —
    CVE-2013-4940

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2013-4939

    Cross-Site Scripting in yui

    Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows rem…

    yui npm
  • Medium —
    CVE-2013-4941

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2013-4942

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, a…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2013-3300

    Lift Sensitive Information Disclosure

    The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (…

    net.liftweb:lift-webkit_2.7.7 net.liftweb:lift-webkit_2.8.1 net.liftweb:lift-webkit_2.9.0 net.liftweb:lift-webkit_2.9.1 Maven
  • Medium —
    CVE-2013-1879

    Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

    Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

    org.apache.activemq:activemq-client Maven
  • Medium —
    CVE-2013-2248 Public exploit EPSS 95%

    Open redirect in Apache Struts

    Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

    org.apache.struts:struts2-core Maven
  • Medium 6.3
    CVE-2013-3245

    plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attacker…

    vlc Debian
  • Medium —
    CVE-2013-2096

    OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image

    OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not cont…

    nova nova Debian PyPI
  • Medium 5.4
    CVE-2013-4729

    phpMyAdmin Global variables scope injection vulnerability

    import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafte…

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist
  • Medium —
    CVE-2012-6144

    Typo3 Backend History Module Vulnerable to SQL Injection

    SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.

    typo3/cms Packagist