Archive
20 August 2013
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x bef…
-
Unscored —
Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, w…
-
Unscored —
Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect use…
-
Unscored —
Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remot…
-
Unscored —
The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows at…
-
Unscored —
Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP r…
-
Unscored —
The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE b…
-
Unscored —
Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it …
-
Medium —
Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: th…
-
Medium —
OpenStack Swift allows authenticated users to cause a denial of service
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
-
Unscored —
Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the p…
-
Unscored —
Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges b…
-
Unscored —
Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santua…
-
Unscored —
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml…
-
Unscored —
Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which…
-
Unscored —
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka x…
-
Medium —
Inefficient Algorithmic Complexity in Apache Santuario XML Security
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify …
-
Unscored —
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote a…
-
Unscored —
Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache …
-
High —
OpenStack Swift Unchecked user input in XML responses
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
-
High —
CoolURI extension for TYPO3 vulnerable to SQL Injection
SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
-
Low —
Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the Static Info Tables (static_info_tables) extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Spambot module 6.x-3.x before 6.x-3.2 and 7.x-1.x before 7.x-1.1 for Dr…
-
Unscored —CVE-2013-5317 Public exploit
Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scr…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassi…
-
Unscored —CVE-2013-5321 Public exploit
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remo…
-
Unscored —CVE-2013-5316 Public exploit
Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication o…
-
Unscored —CVE-2013-5318 Public exploit
SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang pa…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcate…