Skip to content
OpenAdvisories

Archive

2 January 2014

Vulnerabilities first published on this day (UTC), newest first.

← December 2013 2014 / January /2 February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

22 results · Feed

  • Unscored —
    CVE-2009-5137 Public exploit

    Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a l…

  • Medium —
    CVE-2013-2119

    Phusion Passenger Denial of Service

    Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before…

    passenger RubyGems
  • Unscored —
    CVE-2013-6953

    BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the …

  • Unscored —
    CVE-2013-7257

    Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML…

  • Unscored —
    CVE-2013-7240 Public exploit Scanner template EPSS 20%

    Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote…

  • Unscored —
    CVE-2013-7255

    Open redirect vulnerability in Opsview before 4.4.2 allows remote attackers to redirect users to arbitrary web sites an…

  • Unscored —
    CVE-2013-7258

    Cross-site scripting (XSS) vulnerability in web2ldap 1.1.x before 1.1.49 allows remote attackers to inject arbitrary we…

    web2ldap Ubuntu
  • Unscored —
    CVE-2013-7256

    Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentic…

  • Unscored —
    CVE-2013-7254

    Cross-site scripting (XSS) vulnerability in Opsview before 4.4.2 allows remote attackers to inject arbitrary web script…

  • Unscored —
    CVE-2013-6992

    Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugi…

  • Unscored —
    CVE-2013-6991

    Cross-site scripting (XSS) vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote …

  • Unscored —
    CVE-2013-6993

    Cross-site scripting (XSS) vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attacker…

  • Unscored —
    CVE-2011-5269

    Cross-site scripting (XSS) vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbit…

  • Medium —
    CVE-2013-7225

    Fat Free CRM vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

    fat_free_crm RubyGems
  • Unscored —
    CVE-2013-7251

    Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack …

  • Medium —
    CVE-2013-7224

    Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

    Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7249

    Fat Free CRM vulnerable to Exposure of Sensitive Information

    Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7222

    Fat Free CRM has fixed token value

    config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

    fat_free_crm RubyGems
  • Unscored —
    CVE-2013-7250

    Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote aut…

  • Medium —
    CVE-2013-7223

    Fat Free CRM contains Cross-site Request Forgery vulnerablilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/appl…

    fat_free_crm RubyGems
  • Unscored —
    CVE-2013-5211 Public exploit EPSS 98%

    The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of servic…

    ntp Debian
  • Unscored —
    CVE-2013-5385

    The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, …