CVEs published in December 2013

472 vulnerabilities, 56 critical, 1 exploited.

• barebones bbedit, textwrangler, yojimbo +2 more The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler... CVE-2013-3667 6.4 MediumDecember 31, 2013
• ui unifi controller Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in... CVE-2013-3572 6.1 MediumDecember 31, 2013
• op5 monitor op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows... CVE-2012-0264 10.0 HighDecember 31, 2013
• op5 monitor monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users... CVE-2012-0263 4.0 MediumDecember 31, 2013
• op5 monitor, system-op5config +1 more op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3... CVE-2012-0262 Public exploit EPSS 72.9% 10.0 HighDecember 31, 2013
• op5 monitor, system-portal +1 more license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows... CVE-2012-0261 Public exploit EPSS 73.9% 10.0 HighDecember 31, 2013
• synology diskstation manager Multiple directory traversal vulnerabilities in the FileBrowser components in Synology... CVE-2013-6987 Public exploit EPSS 14.9% 7.5 HighDecember 31, 2013
• mislav marohnic will paginate will_paginate Cross-site Scripting vulnerability CVE-2013-6459 Fix available 4.3 MediumDecember 31, 2013
• jenkins Jenkins allows Cross-Site Scripting (XSS) in User Configuration CVE-2013-5573 Public exploit 4.3 MediumDecember 31, 2013
• zenphoto SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4... CVE-2013-7242 6.5 MediumDecember 31, 2013
• zenphoto Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions... CVE-2013-7241 4.3 MediumDecember 31, 2013
• cisco unified presence server SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote... CVE-2013-6983 6.5 MediumDecember 31, 2013
• canonical ubuntu linux, samsung x14j firmware +1 more Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9... CVE-2013-7447 Fix available 6.5 MediumDecember 31, 2013
• debian linux, linux kernel, canonical ubuntu linux +2 more The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel... CVE-2013-7421 Fix available 2.1 LowDecember 31, 2013
• clamav clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial... CVE-2013-6497 Fix available 2.1 LowDecember 31, 2013
• linuxcontainers lxc The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write... CVE-2013-6441 Fix available 7.2 HighDecember 31, 2013
• artifex afpl ghostscript, debian linux +1 more The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which... CVE-2013-5653 Fix available 5.5 MediumDecember 31, 2013
• puppet enterprise, puppetlabs puppet, canonical ubuntu linux +1 more +3 more Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3... CVE-2013-4969 Fix available 2.1 LowDecember 31, 2013
• jforum Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in... CVE-2013-7209 Public exploit 6.8 MediumDecember 30, 2013
• wordpress Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options... CVE-2013-7233 Public exploit 6.8 MediumDecember 30, 2013
• esri arcgis server SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to... CVE-2013-7232 7.5 HighDecember 30, 2013
• esri arcgis server Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server... CVE-2013-7231 3.5 LowDecember 30, 2013
• esri arcgis server Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote... CVE-2013-5222 3.5 LowDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a... CVE-2013-5220 Public exploit 6.1 MediumDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote... CVE-2013-5219 Public exploit 3.3 LowDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows... CVE-2013-5218 Public exploit 2.9 LowDecember 30, 2013
• adtran aos, netvanta 7100, netvanta 7060 +2 more Cross-site scripting (XSS) vulnerability in the GUI login page in ADTRAN AOS before R10.8.1 on... CVE-2013-5210 4.3 MediumDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX... CVE-2013-5039 Public exploit 5.4 MediumDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by... CVE-2013-5038 Public exploit 5.8 MediumDecember 30, 2013
• hot hotbox router, hotbox router firmware +1 more The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it... CVE-2013-5037 Public exploit 3.3 LowDecember 30, 2013
• microsoft windows movie maker Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a... CVE-2013-4858 Public exploit EPSS 13.3% 4.3 MediumDecember 30, 2013
• hp service manager, service manager web client, service manager web tier +2 more Cross-site scripting (XSS) vulnerability in HP Service Manager WebTier and Windows Client 9.20... CVE-2013-6198 4.3 MediumDecember 29, 2013
• hp service manager, service manager web client, service manager web tier +2 more Unspecified vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9... CVE-2013-6197 5.2 MediumDecember 29, 2013
• hp application information optimizer Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer ... CVE-2013-6189 EPSS 16.6% 10.0 HighDecember 29, 2013
• joomla joomla\! Joomla! Cross-site Scripting vulnerability CVE-2013-5583 Fix available 4.3 MediumDecember 29, 2013
• microsoft internet explorer Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to... CVE-2013-3846 Public exploit EPSS 22.0% 9.3 HighDecember 29, 2013
• matrix42 service store Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42... CVE-2013-2504 Public exploit 4.3 MediumDecember 29, 2013
• openx, revive-adserver revive adserver +1 more SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation... CVE-2013-7149 7.5 HighDecember 28, 2013
• cisco ios xe Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet... CVE-2013-6981 5.4 MediumDecember 28, 2013
• irfanview Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used,... CVE-2013-6932 7.6 HighDecember 28, 2013
• cybozu garoon SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated... CVE-2013-6929 6.5 MediumDecember 28, 2013
• realvnc RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a... CVE-2013-6886 7.2 HighDecember 28, 2013
• nextdc onedc The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers,... CVE-2013-6812 5.8 MediumDecember 28, 2013
• zend zendto Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows... CVE-2013-6808 4.3 MediumDecember 28, 2013
• emc replication manager Unquoted Windows search path vulnerability in EMC Replication Manager before 5.5 allows local... CVE-2013-6182 7.2 HighDecember 28, 2013
• emc watch4net EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository,... CVE-2013-6181 2.1 LowDecember 28, 2013
• cybozu garoon Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a... CVE-2013-6006 5.8 MediumDecember 28, 2013
• novell identity manager roles based provisioning module Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before... CVE-2013-1096 4.3 MediumDecember 28, 2013
• hp linux imaging and printing project base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to... CVE-2013-6402 Fix available 2.1 LowDecember 28, 2013
• x display manager X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using... CVE-2013-2179 Fix available 4.3 MediumDecember 27, 2013
• Show olderLoading…