Archive
September 2013
Vulnerabilities first published in this month (UTC), newest first.
44 results · Clear filters · Feed
-
Unscored —CVE-2013-2218 Public exploit
Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1…
-
Unscored —CVE-2013-5697 Public exploit
SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote a…
-
Unscored —CVE-2013-4362 Public exploit
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (…
-
Unscored —CVE-2013-5693 Public exploit
Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web s…
-
Unscored —CVE-2013-5692 Public exploit
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include an…
-
Medium —CVE-2013-4378 Public exploit
Improper Neutralization of Input During Web Page Generation in JavaMelody
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
-
Unscored —CVE-2013-5961 Public exploit
Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attacker…
-
Unscored —
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 …
-
Unscored —
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow r…
-
Critical 9.0
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
-
Unscored —CVE-2013-5118 Public exploit
Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attacke…
-
Medium 6.2CVE-2013-2217 Public exploit
Improper Link Resolution Before File Access in Suds
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
-
Unscored —CVE-2013-5917 Public exploit
SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers …
-
Unscored —
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager…
-
Unscored —CVE-2013-5696 Public exploit
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installat…
-
Unscored —CVE-2013-5147 Public exploit
Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attacker…
-
Unscored —CVE-2013-1727 Public exploit
Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cros…
-
High 8.8
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throu…
KEV Aug 12, 2025 -
Unscored —CVE-2013-3615 Public exploit
Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependen…
-
Unscored —CVE-2013-3613 Public exploit
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain acces…
-
Unscored —
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, whic…
-
Unscored —CVE-2013-3614 Public exploit
Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to …
-
Unscored —
client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, a…
-
Critical 9.8
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle…
KEV Mar 25, 2022 -
Unscored —
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and …
-
Unscored —
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0,…
-
High 8.1
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote …
-
Unscored —
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service …
-
Unscored —
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows rem…
-
Unscored —CVE-2013-3934 Public exploit
Stack-based buffer overflow in Kingsoft Writer 2012 8.1.0.3030, as used in Kingsoft Office 2013 before 9.1.0.4256, allo…
-
Unscored —CVE-2013-5672 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow r…
-
Unscored —CVE-2013-5673 Public exploit
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attac…
-
Unscored —CVE-2013-4984 Public exploit
The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.…
-
Unscored —
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allow…
-
Unscored —CVE-2013-4900 Public exploit
Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remot…
-
Unscored —CVE-2013-5716 Public exploit
Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (applica…
-
Unscored —CVE-2013-1650 Public exploit
Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak permissions (group "oth…
-
Unscored —CVE-2013-1648 Public exploit
The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does…
-
Unscored —CVE-2013-1651 Public exploit
OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.50…