Skip to content
OpenAdvisories

Archive

December 2013

Vulnerabilities first published in this month (UTC), newest first.

← November 2013 2013 / December January 2014 →
  1. 14
  2. 29
  3. 35
  4. 49
  5. 529
  6. 62
  7. 753
  8. 8 
  9. 946
  10. 1013
  11. 1137
  12. 1217
  13. 1327
  14. 1441
  15. 15 
  16. 161
  17. 1720
  18. 1816
  19. 1923
  20. 207
  21. 2132
  22. 228
  23. 2322
  24. 2415
  25. 25 
  26. 261
  27. 275
  28. 2811
  29. 296
  30. 3013
  31. 3112
All Critical High Medium Low Exploited only Public exploit

23 results · Clear filters · Feed

  • Medium —
    CVE-2013-6459

    will_paginate Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.

    will_paginate ruby-will-paginate Debian RubyGems
  • Medium 4.3
    CVE-2013-2030

    OpenStack Nova uses insecure keystone middleware tmpdir by default

    keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demons…

    python-keystoneclient PyPI
  • Medium —
    CVE-2013-7080

    TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

    The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database …

    typo3/cms-core Packagist
  • Medium —
    CVE-2013-7081

    TYPO3 Improper Access Control vulnerability

    The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via u…

    typo3/cms-core Packagist
  • Medium 6.3
    CVE-2013-7075

    TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have …

    typo3/cms Packagist
  • Medium 6.5
    CVE-2013-7073

    TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecifie…

    typo3/cms Packagist
  • Medium —
    CVE-2013-7079

    TYPO3 OpenID extension Open redirect vulnerability

    Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecifie…

    friendsoftypo3/openid Packagist
  • Medium —
    CVE-2013-7082

    TYPO3 Flow Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input…

    typo3/flow neos/flow Packagist
  • Medium —
    CVE-2013-7077

    TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module

    Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms-core Packagist
  • Medium —
    CVE-2013-5676 Public exploit

    Jenkins SonarQube Plugin Stores Passwords in Cleartext

    The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

    org.jenkins-ci.plugins:sonar Maven
  • Medium —
    CVE-2013-1812

    Denial of service in ruby-openid

    The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

    ruby-openid ruby-openid Debian RubyGems
  • Medium 5.5
    CVE-2013-3900 Exploited Public exploit EPSS 45%

    WinVerifyTrust Signature Validation Vulnerability

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 10, 2022
  • Medium —
    CVE-2013-4479

    Sup Code Injection vulnerability

    lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.

    sup sup-mail Debian RubyGems
  • Medium —
    CVE-2013-4478

    Sup Code Injection vulnerability

    Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.

    sup sup-mail Debian RubyGems
  • Medium —
    CVE-2013-6408 EPSS 11%

    XML Injection in Apache Solr

    The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity refe…

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-6397 EPSS 57%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Solr

    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. …

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-6407 EPSS 11%

    Apache Solr UpdateRequestHandler for XML resolves XML External Entities

    The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    org.apache.solr:solr-core lucene-solr Debian Maven
  • Medium —
    CVE-2013-4491

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML v…

    actionpack RubyGems
  • Medium —
    CVE-2013-4492

    i18n gem Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

    i18n ruby-i18n ruby-i18n Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-6415

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit pa…

    actionpack RubyGems
  • Medium —
    CVE-2013-6414 Public exploit EPSS 21%

    actionpack Improper Input Validation vulnerability

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive …

    actionpack RubyGems
  • Medium —
    CVE-2013-6416

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

    actionpack RubyGems
  • Medium —
    CVE-2013-6417

    actionpack allows bypass of database-query restrictions

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to b…

    actionpack RubyGems