Skip to content
OpenAdvisories

Archive

23 January 2014

Vulnerabilities first published on this day (UTC), newest first.

← December 2013 2014 / January /23 February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

25 results · Feed

  • Medium —
    CVE-2013-7315

    Missing XML Validation in Spring Framework

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Low —
    CVE-2013-7048

    OpenStack Nova live snapshots use an insecure local directory

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

    nova nova Debian PyPI
  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Unscored —
    CVE-2013-6934 EPSS 28%

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media …

  • Unscored —
    CVE-2013-6933 EPSS 17%

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in …

    vlc mplayer liblivemedia Debian
  • Unscored —
    CVE-2013-5371

    The client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient Fi…

  • Unscored —
    CVE-2014-0494

    Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption…

  • Unscored —
    CVE-2014-1242

    Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof…

  • Unscored —
    CVE-2013-7314

    The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate…

  • Unscored —
    CVE-2013-7310

    The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link S…

  • Unscored —
    CVE-2013-7308

    The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of …

  • Unscored —
    CVE-2013-7306

    The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link …

  • Unscored —
    CVE-2013-7313

    The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibi…

  • Unscored —
    CVE-2013-7311

    The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possib…

  • Unscored —
    CVE-2013-7312

    The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID …

  • Unscored —
    CVE-2013-7309

    The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in…

  • Unscored —
    CVE-2013-7307

    The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of d…

  • Unscored —
    CVE-2012-6447

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject …

  • Unscored —
    CVE-2014-0675

    The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate…

  • Unscored —
    CVE-2013-6443

    CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forger…

  • Unscored —
    CVE-2014-0979

    The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handl…

    lightdm-gtk-greeter Debian
  • High 7.5
    CVE-2014-0006

    OpenStack Swift Discloses Secret URLs to Timing Attack

    The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

    swift swift Debian PyPI
  • Unscored —
    CVE-2013-6448

    The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web…

  • Unscored —
    CVE-2013-6412

    The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission val…

    augeas Debian
  • Unscored —
    CVE-2013-6447

    Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHa…