Skip to content
OpenAdvisories

Archive

7 December 2013

Vulnerabilities first published on this day (UTC), newest first.

← November 2013 2013 / December /7 January 2014 →
  1. 14
  2. 29
  3. 35
  4. 49
  5. 529
  6. 62
  7. 753
  8. 8 
  9. 946
  10. 1013
  11. 1137
  12. 1217
  13. 1327
  14. 1441
  15. 15 
  16. 161
  17. 1720
  18. 1816
  19. 1923
  20. 207
  21. 2132
  22. 228
  23. 2322
  24. 2415
  25. 25 
  26. 261
  27. 275
  28. 2811
  29. 296
  30. 3013
  31. 3112
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium —
    CVE-2013-4479

    Sup Code Injection vulnerability

    lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.

    sup sup-mail Debian RubyGems
  • Medium —
    CVE-2013-4478

    Sup Code Injection vulnerability

    Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.

    sup sup-mail Debian RubyGems
  • Medium —
    CVE-2013-6408 EPSS 11%

    XML Injection in Apache Solr

    The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity refe…

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-6397 EPSS 57%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Solr

    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. …

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-6407 EPSS 11%

    Apache Solr UpdateRequestHandler for XML resolves XML External Entities

    The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-4491

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML v…

    actionpack RubyGems
  • Medium —
    CVE-2013-4492

    i18n gem Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

    ruby-i18n ruby-i18n i18n Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-6415

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit pa…

    actionpack RubyGems
  • Medium —
    CVE-2013-6414 Public exploit EPSS 21%

    actionpack Improper Input Validation vulnerability

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive …

    actionpack RubyGems
  • Medium —
    CVE-2013-6416

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

    actionpack RubyGems
  • Medium —
    CVE-2013-6417

    actionpack allows bypass of database-query restrictions

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to b…

    actionpack RubyGems