Archive
August 2013
Vulnerabilities first published in this month (UTC), newest first.
357 results · Feed
-
Unscored —
Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP r…
-
Unscored —
The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE b…
-
Unscored —
Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it …
-
Medium —
Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: th…
-
Medium —
OpenStack Swift allows authenticated users to cause a denial of service
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
-
Unscored —
Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the p…
-
Unscored —
Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges b…
-
Unscored —
Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santua…
-
Unscored —
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml…
-
Unscored —
Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which…
-
Unscored —
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka x…
-
Medium —
Inefficient Algorithmic Complexity in Apache Santuario XML Security
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify …
-
Unscored —
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote a…
-
Unscored —
Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache …
-
High —
OpenStack Swift Unchecked user input in XML responses
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
-
High —
CoolURI extension for TYPO3 vulnerable to SQL Injection
SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
-
Low —
Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the Static Info Tables (static_info_tables) extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Spambot module 6.x-3.x before 6.x-3.2 and 7.x-1.x before 7.x-1.1 for Dr…
-
Unscored —CVE-2013-5317 Public exploit
Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scr…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassi…
-
Unscored —CVE-2013-5321 Public exploit
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remo…
-
Unscored —CVE-2013-5316 Public exploit
Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication o…
-
Unscored —CVE-2013-5318 Public exploit
SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang pa…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcate…
-
Unscored —
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavaila…
-
Unscored —
The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable ass…
-
Unscored —
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH se…
-
Unscored —
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not fre…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal allow remote …
-
Unscored —
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users …
-
Unscored —
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an i…
-
Unscored —
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavaila…
-
Unscored —
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a…
-
High —
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
-
Unscored —
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the s…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject …
-
Medium —
Missing XML Validation in Apache CXF
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) n…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Resource Manager in the MEE submodule (mee.module) in the Scald module …
-
Unscored —
phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via cer…