CVE-2013-2622

CVE-2013-2622 affects UebiMiau 2.7.11 and earlier, enabling reflected XSS via the selected_theme parameter in error.php. Impact: arbitrary HTML/JavaScript execution in the user’s browser. Affected component: error.php (selected_theme). No remediation details are provided in the supplied documents.

CVE-2013-2622

Cross-site Scripting XSS in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selectedtheme" parameter in error.php...

CVE-2013-2621

CVE-2013-2621 corresponds to an open redirect in Telaen = 1.3.1). No exploitation details are provided beyond examples in the sources; no additional exploit methods are documented here.

CVE-2013-3565

CVE-2013-3565 affects VideoLAN VLC Media Player through its HTTP Interface, with multiple XSS vulnerabilities in the web UI. Versions prior to 2.0.7 are affected. An attacker can craft requests to the HTTP endpoints (requests/vlm_cmd.xml, requests/browse.xml) or include a URI in a request, which ...

CVE-2013-3489

CVE-2013-3489 involves a buffer overflow in Media Player Classic - Home Cinema (MPC-HC) prior to 1.7.0. The vulnerability allows remote attackers to execute arbitrary code by supplying a crafted RealMedia .rm file. Impact described as arbitrary code execution with a likely combination of network ...

CVE-2013-3488

CVE-2013-3488 affects Media Player Classic - Home Cinema (MPC-HC) prior to 1.7.0.7858. The vulnerability is a stack-based buffer overflow in processing MPEG-2 Transport Stream (M2TS) files, enabling remote attackers to potentially execute arbitrary code. The public documents specify the affected ...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

CVE-2013-5116

CVE-2013-5116 affects the Android Evernote app prior to 5.5.1. The vulnerability allows password changes via aone‑click setup introduced by an ADB‑backups backdoor, enabling an attacker with physical access to extract a password reset URL from a backup and reset the user’s password without authen...

CVE-2013-5112

Evernote before 5.5.1 has insecure PIN storage...

CVE-2013-3322

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

CVE-2013-5113

CVE-2013-5113 concerns LastPass versions prior to 2.5.1 and an insecure PIN implementation. The vulnerability affects PIN handling in the affected LastPass release(s) and has associated CVSS scores indicating low (2.0) and medium (3.1) impact metrics in different schemes, with local/physical expo...

CVE-2013-5114

The core CVE-2013-5114 issue is described across multiple connected sources as affecting LastPass before version 2.5.1 and enabling a secure wipe bypass. The available documents confirm the affected software/version and the impact (bypass of secure wipe), but do not provide technical details on r...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5112

Evernote before 5.5.1 has insecure PIN storage...

CVE-2013-5112

Evernote for Android (pre-5.5.1) stores PIN data insecurely in the Android container, enabling PIN bypass when an attacker has physical access via ADB backup. The vulnerability affects Evernote Android versions up to 5.5.0, where the PIN protection can be bypassed by backing up and restoring the ...

CVE-2013-2198

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

CVE-2013-4187

The CVE-2013-4187 entry concerns the Drupal Flippy module (7.x-1.x) prior to 7.x-1.2, where access restrictions for nodes are not properly enforced. This allows remote authenticated users with content-access permissions to read a link or alias to a restricted node, effectively bypassing node visi...

CVE-2013-2198

The CVE-2013-2198 entry concerns Drupal’s Login Security module (6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3) where attackers can bypass intended restrictions by supplying a crafted username. The underlying issue is an incorrect use of string filtering in the module which can cause it t...