CVE-2013-4864

MiCasaVerde VeraLite firmware 1.5.408 is affected by a Server-Side Request Forgery (SSRF) vulnerability exposed via the url parameter to cgi-bin/cmh/proxy.sh. Remote attackers can cause the device to initiate HTTP requests to intranet/internal servers. Public references cite Trustwave SpiderLabs ...

CVE-2013-4865

Cross-site request forgery CSRF vulnerability in upgradestep2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter...

CVE-2013-4865

The CVE-2013-4865 entry concerns MiCasaVerde VeraLite firmware 1.5.408. A cross-site request forgery (CSRF) in upgrade_step2.sh could allow a remote attacker to hijack a user’s authenticated session to perform requests that install arbitrary firmware via the squashfs parameter. This vulnerability...

CVE-2013-2060

The vulnerability CVE-2013-2060 affects OpenShift Origin’s download_from_url function. A remote attacker can trigger arbitrary commands by injecting shell metacharacters in the URL used to download a cart, enabling remote code execution with network access and high impact per the provided CVSS me...

CVE-2013-0294

CVE-2013-0294 affects the pyrad library: packet.py before version 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, enabling easier brute-force access to sensitive data. The vulnerability is in the random/entropy source used for authenticators and password hashing...

CVE-2013-4582

CVE-2013-4582 affects GitLab: the functions create_branch, create_tag, import_project, and fork_project in lib/gitlab_projects.rb allow remote authenticated users to include information from local files into the metadata of a Git repository via the web interface. Affected are GitLab 5.0 up to 5.4...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

DEBIAN-CVE-2013-6451

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...

DEBIAN-CVE-2013-1437

Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value...

CVE-2013-1437

Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value...

CVE-2013-1437

Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value...

CVE-2013-6451

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...

CVE-2013-6451

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...

CVE-2013-1437

Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value...

CVE-2013-4583

The CVE-2013-4583 issue affects GitLab: the parse_cmd function in lib/gitlab_shell.rb (and the accompanying gitlab-shell) allows remote authenticated users to gain privileges and clone arbitrary repositories. Affected versions are GitLab 5.0 before 5.4.2, GitLab Community Edition before 6.2.4, Gi...

CVE-2013-4583

Removed by vendor...

CVE-2013-6455

CVE-2013-6455 affects the CentralAuth extension for MediaWiki. The vulnerability allows remote attackers to obtain usernames by manipulating the DOM on a page. Affected versions are MediaWiki with CentralAuth before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1. The issue stems from writi...

CVE-2013-2571

CVE-2013-2571 affects Iris 3.8 (before build 1548) used in Xpient POS. A remote attacker can trigger the cash drawer via a crafted request to TCP port 7510, enabling arbitrary command-like actions without authentication, as demonstrated by PoC code. The vulnerability is caused by an input-validat...

CVE-2013-1895

The CVE-2013-1895 entry concerns the py-bcrypt package for Python, specifically before version 0.3. The issue is a race/concurrency flaw: the module does not properly handle concurrent memory access, which allows attackers to bypass authentication by issuing multiple authentication attempts that ...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...