Skip to content
OpenAdvisories

Archive

August 2013

Vulnerabilities first published in this month (UTC), newest first.

← July 2013 2013 / August September 2013 →
  1. 16
  2. 2 
  3. 35
  4. 47
  5. 54
  6. 69
  7. 715
  8. 82
  9. 934
  10. 10 
  11. 11 
  12. 124
  13. 134
  14. 1424
  15. 156
  16. 1624
  17. 171
  18. 184
  19. 1923
  20. 2030
  21. 2121
  22. 226
  23. 2320
  24. 241
  25. 2524
  26. 26 
  27. 279
  28. 2834
  29. 2912
  30. 309
  31. 3119
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.8
    CVE-2013-3346 Exploited Public exploit EPSS 79%

    Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbit…

    KEV Mar 3, 2022
  • High —
    CVE-2013-5647

    Sounder Contains Arbitrary Command Execution Vulnerability

    lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

    sounder RubyGems
  • High 7.5
    CVE-2013-4111

    python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate

    The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the…

    python-glanceclient python-glanceclient Debian PyPI
  • High 7.5
    CVE-2013-1909

    Apache Qpid Python client Improper certificate validation

    The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an…

    qpid-python PyPI
  • High —
    CVE-2013-4701

    PHP OpenID Library Denial of Service vulnerability

    Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declarati…

    typo3/cms openid/php-openid Packagist
  • High —
    CVE-2013-2161

    OpenStack Swift Unchecked user input in XML responses

    XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.

    swift swift Debian PyPI
  • High —
    CVE-2013-5322

    CoolURI extension for TYPO3 vulnerable to SQL Injection

    SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    bednee/cooluri Packagist
  • High —
    CVE-2013-3567

    Puppet Improper Input Validation vulnerability

    Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

    puppet puppet Debian RubyGems
  • High 8.3
    CVE-2013-1633

    Setuptools vulnerable to Man-in-the-middle attacks

    easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default …

    python-pip setuptools Azure Linux PyPI
  • High 8.4
    CVE-2013-1629

    Improper Input Validation in pip

    pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

    python-virtualenv pip python-pip Debian PyPI
  • High —
    CVE-2013-1630

    pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository

    pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

    pyshop PyPI