Skip to content
OpenAdvisories

Archive

2 January 2014

Vulnerabilities first published on this day (UTC), newest first.

← December 2013 2014 / January /2 February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium —
    CVE-2013-2119

    Phusion Passenger Denial of Service

    Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before…

    passenger RubyGems
  • Medium —
    CVE-2013-7225

    Fat Free CRM vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7224

    Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

    Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7249

    Fat Free CRM vulnerable to Exposure of Sensitive Information

    Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7222

    Fat Free CRM has fixed token value

    config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7223

    Fat Free CRM contains Cross-site Request Forgery vulnerablilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/appl…

    fat_free_crm RubyGems