Archive
November 2013
Vulnerabilities first published in this month (UTC), newest first.
394 results · Feed
-
Unscored —
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory vi…
-
Unscored —
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (cr…
-
Unscored —
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not …
-
Medium —
OpenStack Compute Nova Improper Access Control
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
-
Unscored —
Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remo…
-
Unscored —
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3…
-
Unscored —
The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1)…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier…
-
Unscored —CVE-2013-5694 Public exploit
SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute ar…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 allow remote attackers to inject arbitrary …
-
Unscored —CVE-2011-5267 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, a…
-
Medium 6.5
Minion identity not validated in saltstack
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
-
Unscored —
Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE…
-
High 8.8
Salt has insufficient argument validation in several modules
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
-
High —
SaltStack insecurely uses /tmp
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
-
High 7.5
SaltStack MITM SSH attack in salt-ssh
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
-
High 7.5
SaltStack Privilege Escalation vulnerability
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
-
Unscored —
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify co…
-
Unscored —
Citrix XenDesktop 7.0, when upgraded from XenDesktop 5.x, does not properly enforce policy rule permissions, which allo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in S…
-
Unscored —
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authent…
-
Unscored —
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute ar…
-
Unscored —CVE-2013-4838 EPSS 11%
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute ar…
-
Unscored —
Unspecified vulnerability in the client component in HP Application LifeCycle Management (ALM) before 11 p11 allows rem…
-
Unscored —
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to obtain sen…
-
Unscored —
Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 i…
-
Unscored —
The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.…
-
Unscored —
epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not pr…
-
Unscored —
The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 a…
-
Unscored —CVE-2013-6366 Public exploit
The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary co…
-
Unscored —
The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x be…
-
Unscored —
Unspecified vulnerability in the NBAP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote…
-
Unscored —
The Java process in the Impact server in Cisco Prime Central for Hosted Collaboration Solution (HCS) allows remote atta…
-
Unscored —
Buffer overflow in the Active Template Library (ATL) framework in the VPNAPI COM module in Cisco AnyConnect Secure Mobi…
-
Unscored —
The Safe Search enforcement feature in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security Software does …
-
Unscored —CVE-2013-4348 Public exploit
The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to …
-
Unscored —
The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, w…
-
Unscored —
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain dat…
-
Unscored —CVE-2013-6114 Public exploit
Integer overflow in the OZDocument::parseElement function in Apple Motion 5.0.7 allows remote attackers to cause a deni…
-
Unscored —
The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a cer…