Skip to content
OpenAdvisories

Archive

16 September 2013

Vulnerabilities first published on this day (UTC), newest first.

← August 2013 2013 / September /16 October 2013 →
  1. 1 
  2. 2 
  3. 3 
  4. 43
  5. 517
  6. 617
  7. 7 
  8. 89
  9. 915
  10. 1014
  11. 1165
  12. 1223
  13. 1329
  14. 14 
  15. 15 
  16. 1642
  17. 1712
  18. 1820
  19. 1943
  20. 2020
  21. 21 
  22. 22 
  23. 2327
  24. 249
  25. 2522
  26. 264
  27. 2716
  28. 289
  29. 29 
  30. 3038
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.2
    CVE-2013-4260

    Ansible Arbitrary File Overwrite Vulnerability

    lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.

    ansible PyPI
  • Medium 6.2
    CVE-2013-4183

    OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots

    The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

    cinder cinder Debian PyPI
  • Medium 4.0
    CVE-2013-4259

    Ansible uses a socket with predictable filename in /tmp

    runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

    ansible ansible Debian PyPI
  • Medium —
    CVE-2013-4202

    OpenStack Cinder Denial of Service using XML entities

    The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansio…

    cinder cinder Debian PyPI
  • Medium —
    CVE-2013-4179

    OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

    The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is …

    nova nova Debian PyPI
  • Medium —
    CVE-2013-2256

    OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

    OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and pos…

    nova nova Debian PyPI