Skip to content
OpenAdvisories

Archive

30 September 2013

Vulnerabilities first published on this day (UTC), newest first.

← August 2013 2013 / September /30 October 2013 →
  1. 1 
  2. 2 
  3. 3 
  4. 43
  5. 517
  6. 617
  7. 7 
  8. 89
  9. 915
  10. 1014
  11. 1165
  12. 1223
  13. 1329
  14. 14 
  15. 15 
  16. 1642
  17. 1712
  18. 1820
  19. 1943
  20. 2020
  21. 21 
  22. 22 
  23. 2327
  24. 249
  25. 2522
  26. 264
  27. 2716
  28. 289
  29. 29 
  30. 3038
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    CVE-2013-4310

    Apache Struts2 Broken Access Control Vulnerability

    Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2013-4136

    insecure temporary directory usage in passenger

    ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

    passenger passenger Debian RubyGems
  • Medium —
    CVE-2013-4378 Public exploit

    Improper Neutralization of Input During Web Page Generation in JavaMelody

    Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

    net.bull.javamelody:javamelody-core Maven
  • Medium —
    CVE-2013-5960

    Missing Cryptographic Step in OWASP Enterprise Security API for Java

    The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers …

    org.owasp.esapi:esapi Maven