Skip to content
OpenAdvisories

Archive

January 2014

Vulnerabilities first published in this month (UTC), newest first.

← December 2013 2014 / January February 2014 →
  1. 11
  2. 222
  3. 32
  4. 49
  5. 54
  6. 69
  7. 712
  8. 820
  9. 914
  10. 1024
  11. 114
  12. 1212
  13. 136
  14. 1412
  15. 15142
  16. 1633
  17. 177
  18. 188
  19. 199
  20. 207
  21. 2138
  22. 2219
  23. 2325
  24. 2423
  25. 256
  26. 2628
  27. 271
  28. 2813
  29. 2923
  30. 3017
  31. 318
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2013-6235

    Improper Neutralization of Input During Web Page Generation in JAMon

    Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parame…

    com.jamonapi:jamon Maven
  • Medium —
    CVE-2013-4662

    CiviCRM SQL injection vulnerability via Quick Search API

    The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

    civicrm/civicrm-core Packagist
  • Medium —
    CVE-2013-6429 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attack…

    libspring-java org.springframework:spring-web Debian Maven
  • Medium 6.8
    CVE-2014-0751

    GE Proficy HMI/SCADA Path Traversal

    The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as…

    GE Proficy HMI/SCADA–CIMPLICITY Proficy Process Systems with CIMPLICITY
  • Medium —
    CVE-2013-7315

    Missing XML Validation in Spring Framework

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium 6.5
    CVE-2013-6954

    The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL po…

  • Medium —
    CVE-2013-4517

    Improper Input Validation in Apache Santuario XML Security

    Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

    org.apache.santuario:xmlsec libxml-security-java Debian Maven
  • Medium —
    CVE-2013-6419

    OpenStack Nova Router metadata queries are not restricted by tenant

    Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port,…

    nova nova neutron Debian PyPI
  • Medium —
    CVE-2013-2119

    Phusion Passenger Denial of Service

    Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before…

    passenger RubyGems
  • Medium —
    CVE-2013-7225

    Fat Free CRM vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7224

    Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

    Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7249

    Fat Free CRM vulnerable to Exposure of Sensitive Information

    Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7222

    Fat Free CRM has fixed token value

    config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

    fat_free_crm RubyGems
  • Medium —
    CVE-2013-7223

    Fat Free CRM contains Cross-site Request Forgery vulnerablilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/appl…

    fat_free_crm RubyGems