Skip to content
OpenAdvisories

Archive

November 2013

Vulnerabilities first published in this month (UTC), newest first.

← October 2013 2013 / November December 2013 →
  1. 110
  2. 224
  3. 3 
  4. 420
  5. 523
  6. 69
  7. 7 
  8. 814
  9. 94
  10. 10 
  11. 11 
  12. 1212
  13. 1349
  14. 147
  15. 1522
  16. 1630
  17. 17 
  18. 18 
  19. 1929
  20. 207
  21. 2114
  22. 2214
  23. 2360
  24. 245
  25. 256
  26. 268
  27. 2712
  28. 283
  29. 298
  30. 304
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium —
    CVE-2013-4522

    Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

    lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been pre…

    moodle/moodle Packagist
  • Medium —
    CVE-2013-6373

    Jenkins Exclusion Plugin allows Access to Resource Locks

    The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

    org.jenkins-ci.plugins:exclusion Maven
  • Medium 5.4
    CVE-2013-5223 Exploited Public exploit EPSS 51%

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated us…

    KEV Mar 25, 2022
  • Medium —
    CVE-2013-4204

    Improper Neutralization of Input During Web Page Generation in Google Web Toolkit

    Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    com.google.gwt:gwt Maven
  • Medium 4.7
    CVE-2013-4714

    Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    tikiwiki/tiki-manager Packagist
  • Medium —
    CVE-2013-4497

    OpenStack Compute Nova Improper Access Control

    The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.

    nova nova Debian PyPI
  • Medium 6.5
    CVE-2013-4439

    Minion identity not validated in saltstack

    Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.

    salt PyPI
  • Medium —
    CVE-2013-6348

    Apache Struts is vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2013-4457

    Cocaine Gem OS Command Injection vulnerability

    The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.

    cocaine RubyGems
  • Medium —
    CVE-2013-3630 Public exploit EPSS 42%

    Moodle Authenticated Spelling Binary Remote Code Execution

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.

    moodle/moodle moodle Ubuntu Packagist