7 December 2013

53 results · Feed

• Unscored —
  CVE-2013-0849

  The roq_decode_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspec…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0848

  The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified im…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0844

  Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attacker…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0857

  The decode_frame_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified …

  Dec 7, 2013
• Unscored —
  CVE-2013-0855

  Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to…

  Dec 7, 2013
• Unscored —
  CVE-2013-0859

  The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecif…

  Dec 7, 2013
• Unscored —
  CVE-2013-0854

  The mjpeg_decode_scan_progressive_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to …

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0856

  The lpc_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified im…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0851

  The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified imp…

  Dec 7, 2013
• Unscored —
  CVE-2013-0850

  The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecifi…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0847

  The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified …

  Dec 7, 2013
• Unscored —
  CVE-2013-0845

  libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block le…

  Dec 7, 2013
• Unscored —
  CVE-2013-0853

  The wavpack_decode_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspe…

  Dec 7, 2013
• Unscored —
  CVE-2013-0852

  The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an un…

  Dec 7, 2013
• Unscored —
  CVE-2013-0858

  The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspec…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-0846

  Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attac…

  ffmpeg Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-7000

  The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway 2013.09.26 allows remote attackers to cause a de…

  Dec 7, 2013
• Unscored —
  CVE-2013-7001

  The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway before 2013.11.15 allows remote attackers to cau…

  Dec 7, 2013
• Unscored —
  CVE-2013-6385

  The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs fo…

  Dec 7, 2013
• High 7.5
  CVE-2013-6389

  Drupal has open redirect vulnerability in the Overlay module

  Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  drupal/drupal Packagist
  Dec 7, 2013
• Unscored —
  CVE-2013-6386

  Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predict…

  Dec 7, 2013
• High —
  CVE-2012-6612 EPSS 10%

  Improper Restriction of XML External Entity Reference in Apache Solr

  The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML…

  org.apache.solr:solr-core lucene-solr Debian Maven
  Dec 7, 2013
• Unscored —
  CVE-2013-4171

  Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbi…

  Dec 7, 2013
• Unscored —
  CVE-2013-4212 Public exploit EPSS 81%

  Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute…

  Dec 7, 2013
• Unscored —
  CVE-2013-4445

  The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal use…

  Dec 7, 2013
• Unscored —
  CVE-2013-4558

  The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.…

  subversion Debian
  Dec 7, 2013
• Medium —
  CVE-2013-4479

  Sup Code Injection vulnerability

  lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.

  sup sup-mail Debian RubyGems
  Dec 7, 2013
• Unscored —
  CVE-2013-4446

  The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.…

  Dec 7, 2013
• Unscored —
  CVE-2013-4505

  The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows …

  subversion Debian
  Dec 7, 2013
• Medium —
  CVE-2013-4478

  Sup Code Injection vulnerability

  Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.

  sup sup-mail Debian RubyGems
  Dec 7, 2013
• Medium —
  CVE-2013-6408 EPSS 11%

  XML Injection in Apache Solr

  The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity refe…

  org.apache.solr:solr-core lucene-solr Debian Maven
  Dec 7, 2013
• Unscored —
  CVE-2013-6410

  nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote atta…

  nbd Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-6050

  Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tabl…

  links2 Debian
  Dec 7, 2013
• Medium —
  CVE-2013-6397 EPSS 57%

  Improper Limitation of a Pathname to a Restricted Directory in Apache Solr

  Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. …

  org.apache.solr:solr-core lucene-solr Debian Maven
  Dec 7, 2013
• Medium —
  CVE-2013-6407 EPSS 11%

  Apache Solr UpdateRequestHandler for XML resolves XML External Entities

  The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  org.apache.solr:solr-core lucene-solr Debian Maven
  Dec 7, 2013
• Unscored —
  CVE-2013-6409

  Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibl…

  adequate Debian
  Dec 7, 2013
• Unscored —
  CVE-2013-6707

  Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and ea…

  Dec 7, 2013
• Unscored —
  CVE-2013-5455

  IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment…

  Dec 7, 2013
• Unscored —
  CVE-2013-6999

  The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not…

  Dec 7, 2013
• Medium —
  CVE-2013-4491

  actionpack vulnerable to Cross-site Scripting

  Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML v…

  actionpack RubyGems
  Dec 7, 2013