CVE-2013-3629

CVE-2013-3629 affects ISPConfig 3.0.5.2. The Red Hat/NVD/CVE records and related sources describe an Arbitrary PHP Code Execution vulnerability. The root cause is a flaw in ISPConfig’s content/language handling that allows an authenticated user to cause arbitrary PHP code execution on the server ...

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability...

CVE-2013-3628

CVE-2013-3628 affects Zabbix 2.0.9, described as an Arbitrary Command Execution vulnerability. The connected documents confirm that an authenticated user can create and run scripts on a Zabbix host, enabling remote command execution on the server. Public exploitation is evidenced by references to...

CVE-2013-3591

vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability...

CVE-2013-3591

Summary of CVE-2013-3591 : The vulnerability affects vTiger CRM versions 5.3 and 5.4, where the attacker can abuse the vulnerable vTiger “files” upload folder to upload a PHP script and achieve arbitrary PHP code execution. Multiple connected sources document an authenticated remote-code-executio...

CVE-2013-2008

WordPress Super Cache Plugin 1.3 has XSS...

CVE-2013-4335

The CVE-2013-4335 entry affects opOpenSocialPlugin versions 0.8.2.1 and later up to 1.2.6 (including > 0.9.9.2, 0.9.13). The vulnerability is described as Multiple XML External Entity (XXE) Injection vulnerabilities. Public sources in the connected documents (NVD, Red Hat advisory) indicate hi...

CVE-2013-4334

CVE-2013-4334 affects opWebAPIPlugin versions 0.5.1, 0.4.0, and 0.1.0 with XXE vulnerabilities. Public records note an extremely high impact: CVSS v3.1 base score 9.8 (CRITICAL), using NETWORK attack vector, no privileges required, and no user interaction, with high confidentiality, integrity, an...

CVE-2013-1202

Cisco ACE A2(3.6) is affected by a log-retention Denial of Service vulnerability (CVE-2013-1202). The flaw occurs in the SSL logging daemon where logs are not rotated, exhausting disk space and leading to DoS. An unauthenticated, remote attacker could exploit by opening many SSL connections to th...

CVE-2013-0192

CVE-2013-0192 affects Simple Machines Forum (SMF) up to version 2.0.3. The vulnerability is a file disclosure that enables a forum admin to read sensitive files, such as the database configuration, indicating insufficient access restrictions when handling file operations. The available sources (N...

CVE-2013-2009

The CVE-2013-2009 entry concerns WordPress WP Super Cache Plugin 1.2, which is vulnerable to remote PHP code execution via unsanitized input (e.g., malicious blog comments). Root cause cited as an incomplete fix for CVE-2013-2009. Impact is remote code execution on the web server as the web-serve...

CVE-2013-2009

WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution...

CVE-2013-2008

WordPress Super Cache Plugin 1.3 has XSS...

CVE-2013-2008

The CVE-2013-2008 entry concerns WordPress Super Cache Plugin 1.3 with multiple URI-based XSS vulnerabilities in trunk/plugins/domain-mapping.php, trunk/plugins/awaitingmoderation.php, trunk/plugins/badbehaviour.php, and trunk/wp-cache.php, as reported by several sources. Root cause: XSS in plugi...

CVE-2013-3568

Cisco Linksys WRT110 is affected by CVE-2013-3568, a remote-command-execution vector arising from a CSRF/command-injection issue in the router’s web interface. The vulnerability stems from inadequate input sanitization in the ping handling, combined with a CSRF weakness (missing tokens) that allo...

CVE-2013-3564

The CVE-2013-3564 issue affects VideoLAN VLC media player’s web interface prior to version 2.0.7, where there is no access control. This allows remote attackers to view directory listings via the dir command or execute other commands without authenticating. The root cause is unauthenticated acces...

CVE-2013-2684

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2684

Cisco Linksys E4200 firmware 1.0.05 build 7 is affected by CVE-2013-2684 (XSS). The web UI can be exploited by remote attackers to inject arbitrary JavaScript/HTML via unspecified vectors, potentially impacting the user session or rendered content. CVSS data in the provided documents indicate a n...

CVE-2013-2684

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4521

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-216...