Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2013-6684 | 1 Cisco | 1 Wireless Lan Controller | 2013-11-14 | 6.8 MEDIUM | N/A |
| The web framework on Cisco Wireless LAN Controller (WLC) devices does not properly validate configuration parameters, which allows remote authenticated users to cause a denial of service via a crafted HTTP request, aka Bug ID CSCuh81011. | |||||
| CVE-2013-6682 | 1 Cisco | 1 Adaptive Security Appliance Software | 2013-11-14 | 6.4 MEDIUM | N/A |
| The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 certificates, which allows remote attackers to cause a denial of service (connection-database corruption) via an invalid entry, aka Bug ID CSCui33299. | |||||
| CVE-2013-5990 | 1 Justsystems | 4 Ichitaro, Ichitaro Portable With Oreplug, Ichitaro Pro and 1 more | 2013-11-14 | 9.3 HIGH | N/A |
| Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6, 7, and 2006 through 2010; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen and Gen Trial Edition; Ichitaro Pro; Ichitaro Pro 2 and Pro 2 Trial Edition; Ichitaro Viewer; and Ichitaro Portable with oreplug allows remote attackers to execute arbitrary code via a crafted document. | |||||
| CVE-2013-6357 | 1 Apache | 1 Tomcat | 2013-11-14 | 6.8 MEDIUM | N/A |
| ** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator." | |||||
| CVE-2013-5552 | 1 Cisco | 2 Content Services Gateway, Ios | 2013-11-14 | 6.4 MEDIUM | N/A |
| Cisco IOS 12.4(24)MDB9 and earlier on Content Services Gateway (CSG) devices does not properly implement the "parse error drop" feature, which allows remote attackers to bypass intended access restrictions via a crafted series of packets, aka Bug ID CSCug90143. | |||||
| CVE-2013-5560 | 1 Cisco | 1 Adaptive Security Appliance Software | 2013-11-14 | 5.4 MEDIUM | N/A |
| The IPv6 implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1.3 and earlier, when NAT64 or NAT66 is enabled, does not properly process NAT rules, which allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCue34342. | |||||
| CVE-2013-5568 | 1 Cisco | 1 Adaptive Security Appliance Software | 2013-11-14 | 7.1 HIGH | N/A |
| The auto-update implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier allows remote attackers to cause a denial of service (device reload) via crafted update data, aka Bug ID CSCui33308. | |||||
| CVE-2013-6122 | 1 Qualcomm | 1 Quic Mobile Station Modem Kernel | 2013-11-13 | 6.9 MEDIUM | N/A |
| goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly synchronize updates to a global variable, which allows local users to bypass intended access restrictions or cause a denial of service (memory corruption) via crafted arguments to the procfs write handler. | |||||
| CVE-2013-6789 | 1 Silverstripe | 1 Silverstripe | 2013-11-13 | 5.0 MEDIUM | N/A |
| security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653. | |||||
| CVE-2013-5726 | 1 Tapbots | 1 Tweetbot | 2013-11-13 | 6.8 MEDIUM | N/A |
| Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL. | |||||
| CVE-2013-2653 | 1 Silverstripe | 1 Silverstripe | 2013-11-13 | 5.8 MEDIUM | N/A |
| security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim. | |||||
| CVE-2013-5558 | 1 Cisco | 1 Telepresence Vx Clinical Assistant | 2013-11-08 | 10.0 HIGH | N/A |
| The WIL-A module in Cisco TelePresence VX Clinical Assistant 1.2 before 1.21 changes the admin password to an empty password upon a reboot, which makes it easier for remote attackers to obtain access via the administrative interface, aka Bug ID CSCuj17238. | |||||
| CVE-2013-5554 | 1 Cisco | 1 Wide Area Application Services Mobile | 2013-11-08 | 7.5 HIGH | N/A |
| Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773. | |||||
| CVE-2013-5553 | 1 Cisco | 1 Ios | 2013-11-08 | 7.8 HIGH | N/A |
| Multiple memory leaks in Cisco IOS 15.1 before 15.1(4)M7 allow remote attackers to cause a denial of service (memory consumption or device reload) by sending a crafted SIP message over (1) IPv4 or (2) IPv6, aka Bug IDs CSCuc42558 and CSCug25383. | |||||
| CVE-2013-4987 | 1 Pineapp | 1 Mail-secure | 2013-11-08 | 8.5 HIGH | N/A |
| PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command. | |||||
| CVE-2013-4716 | 1 Tattyan | 1 Tattyan Hptown | 2013-11-08 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Tattyan HP TOWN 5_9_3 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string. | |||||
| CVE-2013-6366 | 1 Vmware | 1 Hyperic Hq | 2013-11-07 | 6.5 MEDIUM | N/A |
| The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call. | |||||
| CVE-2011-5267 | 1 Wikiwig Project | 1 Wikiwig | 2013-11-07 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.01 and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter. NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670. | |||||
| CVE-2013-4435 | 1 Saltstack | 1 Salt | 2013-11-07 | 6.0 MEDIUM | N/A |
| Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine. | |||||
| CVE-2013-4436 | 1 Saltstack | 1 Salt | 2013-11-07 | 9.3 HIGH | N/A |
| The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack. | |||||