Skip to content
OpenAdvisories

Archive

July 2013

Vulnerabilities first published in this month (UTC), newest first.

← June 2013 2013 / July August 2013 →
  1. 113
  2. 29
  3. 324
  4. 411
  5. 5 
  6. 65
  7. 7 
  8. 822
  9. 910
  10. 1071
  11. 1110
  12. 128
  13. 133
  14. 14 
  15. 156
  16. 1613
  17. 1777
  18. 1840
  19. 1913
  20. 20 
  21. 212
  22. 225
  23. 2311
  24. 247
  25. 254
  26. 2624
  27. 27 
  28. 288
  29. 2932
  30. 3015
  31. 3143
All Critical High Medium Low Exploited only Public exploit

486 results · Feed

  • Unscored —
    CVE-2013-3821

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, …

  • Unscored —
    CVE-2013-0246

    The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to de…

  • Unscored —
    CVE-2013-0245

    The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not pr…

  • Unscored —
    CVE-2013-1925

    The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which al…

  • Unscored —
    CVE-2013-1908

    The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly res…

  • Unscored —
    CVE-2013-1907

    The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly res…

  • High —
    CVE-2013-2135 EPSS 14%

    Arbitrary code execution in Apache Struts 2

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Unscored —
    CVE-2013-2122

    The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows rem…

  • High —
    CVE-2013-2134 Public exploit EPSS 70%

    Arbitrary code execution in Apache Struts 2

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Unscored —
    CVE-2013-1935

    A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Lin…

  • Unscored —
    CVE-2013-1943

    The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocatio…

  • Unscored —
    CVE-2013-4117 Public exploit Scanner template EPSS 13%

    Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for…

  • Unscored —
    CVE-2013-3491

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Sharebar plugin 1.2.5 for WordPress allow remote atta…

  • Unscored —
    CVE-2013-2188

    A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on …

  • Unscored —
    CVE-2013-1087

    Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on …

  • Unscored —
    CVE-2013-4125

    The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not prope…

    linux Debian
  • Unscored —
    CVE-2013-3578

    SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows rem…

  • Unscored —
    CVE-2013-3577

    SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows rem…

  • Unscored —
    CVE-2013-3428

    The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which…

  • Unscored —
    CVE-2013-2765 Public exploit EPSS 14%

    The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NU…

    modsecurity-apache Debian
  • Unscored —
    CVE-2013-4113

    ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a d…

  • Unscored —
    CVE-2013-3692

    BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object…

  • Unscored —
    CVE-2013-2351

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.00, 9.1x, and 9.2x allows remote attackers to obtain se…

  • Unscored —
    CVE-2013-3424

    Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System …

  • Unscored —
    CVE-2013-3423

    Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote…

  • Unscored —
    CVE-2013-3421

    Cross-site scripting (XSS) vulnerability in the Help index page in Cisco Secure Access Control System (ACS) allows remo…

  • Unscored —
    CVE-2013-3422

    Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows rem…

  • Unscored —
    CVE-2013-2704

    Cross-site request forgery (CSRF) vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote at…

  • Unscored —
    CVE-2013-3655

    The Sharp AQUOS PhotoPlayer HN-PP150 with firmware before 1.04.00.04 allows remote attackers to cause a denial of servi…

  • Unscored —
    CVE-2013-2688

    Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform a…

  • Unscored —
    CVE-2013-2687

    Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2…

  • High —
    CVE-2013-1768

    Deserialization of Untrusted Data in Apache OpenJPA

    The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attac…

    org.apache.openjpa:openjpa openjpa Debian Maven
  • High —
    CVE-2013-1777

    Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

    The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbit…

    org.apache.geronimo.framework:geronimo-jmx-remoting Maven
  • Unscored —
    CVE-2013-3419

    Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inje…

  • Unscored —
    CVE-2013-3418

    Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests, which allows r…

  • Unscored —
    CVE-2013-4686

    The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.…

  • Unscored —
    CVE-2013-4690

    Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X4…

  • Unscored —
    CVE-2013-4687

    flowd in Juniper Junos 10.4 before 10.4S14, 11.2 and 11.4 before 11.4R6-S2, and 12.1 before 12.1R6 on SRX devices, when…

  • Unscored —
    CVE-2013-4684

    flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R8, 12.1 before 12.1R7, and 12.1X44 before 12.1X44-D15 on S…

  • Unscored —
    CVE-2013-4688

    flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices, when the MSRPC Application Layer Gateway (ALG) is enabled, a…