CVE-2014-0008: Undefined Security Weakness

lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report...

CVE-2014-1236

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."...

CVE-2014-1236: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."...

CVE-2013-7138: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the start parameter...

CVE-2013-6808: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php...

CVE-2013-7102: Improper Input Validation

Multiple unrestricted file upload vulnerabilities in 1 media-upload.php, 2 media-upload-lncthumb.php, and 3 media-upload-sqbutton.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extensio...

CVE-2013-7086

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message...

PT-2013-6266

Name of the Vulnerable Software and Affected Versions Webbynode gem versions 1.0.5.3 and earlier Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message. This is due to a problem in the message function in...

CVE-2013-2751: Improper Control of Generation of Code

Eval injection vulnerability in frontview/lib/nphandler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."...

PT-2013-3912

Name of the Vulnerable Software and Affected Versions ReadyNAS RAIDiator versions prior to 4.1.12 ReadyNAS RAIDiator versions 4.2.x prior to 4.2.24 Description The issue is related to an eval injection vulnerability in the FrontView web interface, specifically in the frontview/lib/np handler.pl...

CVE-2013-2752: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

PT-2013-3913

Name of the Vulnerable Software and Affected Versions NETGEAR ReadyNAS RAIDiator versions prior to 4.1.12 NETGEAR ReadyNAS RAIDiator versions 4.2.x prior to 4.2.24 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of users. This is due to a...

PT-2013-5041

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.x through 3.2.15 Ruby on Rails versions 4.x through 4.0.1 Description A cross-site scripting XSS issue exists in the internationalization component, allowing remote attackers to inject arbitrary web script or HTML via ...

PT-2013-6037

Name of the Vulnerable Software and Affected Versions Action View in Ruby on Rails versions 3.x through 3.2.15 Action View in Ruby on Rails versions 4.x through 4.0.1 Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption, via a header containi...

PT-2013-6039

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 4.0.0 through 4.0.1 Description A cross-site scripting XSS issue exists in the simple format helper, located in actionpack/lib/action view/helpers/text helper.rb, allowing remote attackers to inject arbitrary web script ...

CVE-2013-4479: Improper Control of Generation of Code

lib/sup/messagechunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the contenttype of an email attachment...

CVE-2013-6712: Improper Restriction of Operations within the Bounds of a Memory Buffer

The scan function in ext/date/lib/parseisointervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service heap-based buffer over-read via a crafted interval specification...

CVE-2013-4522

lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy...

CVE-2013-4522: Exposure of Sensitive Information to an Unauthorized Actor

lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy...

CVE-2013-4481

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."...