Skip to content
OpenAdvisories

Archive

December 2013

Vulnerabilities first published in this month (UTC), newest first.

← November 2013 2013 / December January 2014 →
  1. 14
  2. 29
  3. 35
  4. 49
  5. 529
  6. 62
  7. 753
  8. 8 
  9. 946
  10. 1013
  11. 1137
  12. 1217
  13. 1327
  14. 1441
  15. 15 
  16. 161
  17. 1720
  18. 1816
  19. 1923
  20. 207
  21. 2132
  22. 228
  23. 2322
  24. 2415
  25. 25 
  26. 261
  27. 275
  28. 2811
  29. 296
  30. 3013
  31. 3112
All Critical High Medium Low Exploited only Public exploit

484 results · Feed

  • Unscored —
    CVE-2013-3572

    Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi…

  • Unscored —
    CVE-2013-3667

    The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit …

  • Unscored —
    CVE-2012-0261 Public exploit EPSS 74%

    license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to exec…

  • Unscored —
    CVE-2012-0262 Public exploit EPSS 73%

    op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attacker…

  • Unscored —
    CVE-2012-0264

    op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to hav…

  • Unscored —
    CVE-2012-0263

    monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive i…

  • Medium —
    CVE-2013-6459

    will_paginate Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.

    ruby-will-paginate will_paginate Debian RubyGems
  • Unscored —
    CVE-2013-6987 Public exploit EPSS 15%

    Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before…

  • Low —
    CVE-2013-5573 Public exploit

    Jenkins allows Cross-Site Scripting (XSS) in User Configuration

    Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2013-7242

    SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote auth…

  • Unscored —
    CVE-2013-7241

    Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto befo…

  • Unscored —
    CVE-2013-6983

    SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to …

  • Unscored —
    CVE-2013-7209 Public exploit

    Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attac…

  • Unscored —
    CVE-2013-7232

    SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL com…

  • Unscored —
    CVE-2013-7233 Public exploit

    Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPr…

    wordpress wordpress Debian Ubuntu
  • Unscored —
    CVE-2013-7231

    Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows re…

  • Unscored —
    CVE-2013-4858 Public exploit EPSS 13%

    Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (applic…

  • Unscored —
    CVE-2013-5038 Public exploit

    The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP …

  • Unscored —
    CVE-2013-5219 Public exploit

    Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitra…

  • Unscored —
    CVE-2013-5220 Public exploit

    goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device…

  • Unscored —
    CVE-2013-5218 Public exploit

    Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to injec…

  • Unscored —
    CVE-2013-5039 Public exploit

    Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.…

  • Unscored —
    CVE-2013-5037 Public exploit

    The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attacker…

  • Unscored —
    CVE-2013-5222

    Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to …

  • Unscored —
    CVE-2013-5210

    Cross-site scripting (XSS) vulnerability in the GUI login page in ADTRAN AOS before R10.8.1 on the NetVanta 7100 allows…

  • Unscored —
    CVE-2013-6198

    Cross-site scripting (XSS) vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661…

  • Unscored —
    CVE-2013-6197

    Unspecified vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661 p8 allows remo…

  • Unscored —
    CVE-2013-6189 EPSS 17%

    Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer (formerly HP Database Arc…

  • Unscored —
    CVE-2013-3846 Public exploit EPSS 22%

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …

  • Unscored —
    CVE-2013-2504 Public exploit

    Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42 Service Store 5.3 SP3 (…

  • Low —
    CVE-2013-5583

    Joomla! Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

    joomla/joomla-cms Packagist
  • Unscored —
    CVE-2013-7149

    SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver…

  • Unscored —
    CVE-2013-1096

    Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell I…

  • Unscored —
    CVE-2013-6932

    Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remot…

  • Unscored —
    CVE-2013-6981

    Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fra…

  • Unscored —
    CVE-2013-6181

    EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository, which allows local us…

  • Unscored —
    CVE-2013-6182

    Unquoted Windows search path vulnerability in EMC Replication Manager before 5.5 allows local users to gain privileges …

  • Unscored —
    CVE-2013-6812

    The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-…

  • Unscored —
    CVE-2013-6886

    RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) …

  • Unscored —
    CVE-2013-6929

    SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary…