Skip to content
OpenAdvisories

Archive

23 December 2013

Vulnerabilities first published on this day (UTC), newest first.

← November 2013 2013 / December /23 January 2014 →
  1. 14
  2. 29
  3. 35
  4. 49
  5. 529
  6. 62
  7. 753
  8. 8 
  9. 946
  10. 1013
  11. 1137
  12. 1217
  13. 1327
  14. 1441
  15. 15 
  16. 161
  17. 1720
  18. 1816
  19. 1923
  20. 207
  21. 2132
  22. 228
  23. 2322
  24. 2415
  25. 25 
  26. 261
  27. 275
  28. 2811
  29. 296
  30. 3013
  31. 3112
All Critical High Medium Low Exploited only Public exploit

22 results · Feed

  • Medium —
    CVE-2013-7080

    TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

    The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database …

    typo3/cms-core Packagist
  • Unscored —
    CVE-2013-7102 Public exploit EPSS 15%

    Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media…

  • Medium —
    CVE-2013-7081

    TYPO3 Improper Access Control vulnerability

    The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via u…

    typo3/cms-core Packagist
  • Medium 6.3
    CVE-2013-7075

    TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have …

    typo3/cms Packagist
  • Medium 6.5
    CVE-2013-7073

    TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecifie…

    typo3/cms Packagist
  • Medium —
    CVE-2013-7079

    TYPO3 OpenID extension Open redirect vulnerability

    Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecifie…

    friendsoftypo3/openid Packagist
  • Unscored —
    CVE-2013-7049

    Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and ear…

  • Unscored —
    CVE-2013-4424

    Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow …

  • Unscored —
    CVE-2013-3709

    WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges …

  • Unscored —
    CVE-2013-4414

    Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remot…

  • Unscored —
    CVE-2013-4404

    cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users …

  • Unscored —
    CVE-2013-4549

    QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) …

    qtbase-opensource-src qtbase-opensource-src qt4-x11 phantomjs Debian Ubuntu
  • Unscored —
    CVE-2013-4405

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Gri…

  • Unscored —
    CVE-2013-4461

    SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers t…

  • Unscored —
    CVE-2013-6439

    Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuratio…

  • Unscored —
    CVE-2013-6449 EPSS 21%

    The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorr…

    openssl Debian
  • Unscored —
    CVE-2013-6890 Public exploit

    denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to…

  • Unscored —
    CVE-2013-6979

    The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS int…

  • Unscored —
    CVE-2013-6422

    The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYP…

    curl Debian
  • Unscored —
    CVE-2013-5420

    The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote…

  • Unscored —
    CVE-2013-2629

    Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to t…

  • Unscored —
    CVE-2013-5973

    VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the V…