Archive
December 2013
Vulnerabilities first published in this month (UTC), newest first.
61 results · Clear filters · Feed
-
Unscored —
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to exec…
-
Unscored —
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attacker…
-
Unscored —
Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before…
-
Low —CVE-2013-5573 Public exploit
Jenkins allows Cross-Site Scripting (XSS) in User Configuration
Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
-
Unscored —CVE-2013-7209 Public exploit
Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attac…
-
Unscored —CVE-2013-7233 Public exploit
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPr…
-
Unscored —
Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (applic…
-
Unscored —CVE-2013-5038 Public exploit
The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP …
-
Unscored —CVE-2013-5219 Public exploit
Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitra…
-
Unscored —CVE-2013-5220 Public exploit
goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device…
-
Unscored —CVE-2013-5218 Public exploit
Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to injec…
-
Unscored —CVE-2013-5039 Public exploit
Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.…
-
Unscored —CVE-2013-5037 Public exploit
The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attacker…
-
Unscored —
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …
-
Unscored —CVE-2013-2504 Public exploit
Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42 Service Store 5.3 SP3 (…
-
Unscored —
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media…
-
Unscored —CVE-2013-6890 Public exploit
denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to…
-
Unscored —CVE-2013-7193 Public exploit
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary S…
-
Unscored —CVE-2013-7194 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remot…
-
Unscored —CVE-2013-7192 Public exploit
Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbi…
-
Unscored —CVE-2013-6162 Public exploit
Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject a…
-
Unscored —CVE-2013-2627 Public exploit
SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to …
-
Unscored —CVE-2013-7189 Public exploit
Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrar…
-
Unscored —CVE-2013-7187 Public exploit
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers…
-
Unscored —
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long…
-
Unscored —CVE-2013-7190 Public exploit
Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbit…
-
Unscored —CVE-2013-6767 Public exploit
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary c…
-
Unscored —CVE-2013-7136 Public exploit
The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK p…
-
Unscored —
Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.173…
-
Unscored —CVE-2013-6976 Public exploit
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers …
-
Unscored —CVE-2013-4776 Public exploit
NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows…
-
Unscored —
NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with…
-
Unscored —CVE-2013-6883 Public exploit
Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allo…
-
Unscored —CVE-2013-6882 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and ear…
-
Unscored —
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5…
-
Unscored —
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zi…
-
Medium —CVE-2013-5676 Public exploit
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
-
Unscored —CVE-2012-6151 Public exploit
Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote a…
-
Unscored —
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCou…
-
Unscored —CVE-2013-6839 Public exploit
SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary S…