CVE-2013-1627

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub401A90 CreateFileW function...

CVE-2013-1609

Multiple unquoted Windows search path vulnerabilities in the 1 File Collector and 2 File PlaceHolder services in Symantec Enterprise Vault EV for File System Archiving before 9.0.4 and 10.x before 10.0.1 allow local users to gain privileges via a Trojan horse program...

CVE-2013-1159

Cross-site scripting XSS vulnerability in the Netcool Impact NCI web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56706...

CVE-2013-1649

Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2013-1227

Cross-site scripting XSS vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCug37902...

CVE-2013-1182

The login page in the Web Console in the Manager component in Cisco Unified Computing System UCS before 1.02h, 1.1 before 1.11j, and 1.3x allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207...

CVE-2013-1137

Cisco Unified Presence Server CUPS 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service CPU consumption via crafted packets to the SIP TCP port, aka Bug ID CSCua89930...

CVE-2013-1218

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

CVE-2013-1164

Cisco IOS XE 3.4 before 3.4.4S, 3.5, and 3.6 on 1000 series Aggregation Services Routers ASR does not properly implement the Cisco Multicast Leaf Recycle Elimination MLRE feature, which allows remote attackers to cause a denial of service card reload via fragmented IPv6 multicast packets, aka Bug...

CVE-2013-1614

Multiple cross-site scripting XSS vulnerabilities in the management console aka Java console on the Symantec Security Information Manager SSIM appliance 4.7.x and 4.8.x before 4.8.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1140

The XML parser in Cisco Security Monitoring, Analysis, and Response System MARS allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCue55093...

CVE-2013-1184

The management API in the XML API management service in the Manager component in Cisco Unified Computing System UCS 1.x before 1.21b allows remote attackers to cause a denial of service service outage via a malformed request, aka Bug ID CSCtg48206...

CVE-2013-1908

The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors...

CVE-2013-1405

VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management...

CVE-2013-1441

econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service crash via a crafted image file...

CVE-2013-1423

1 contrib/gforge-3.0-cronjobs.patch, 2 cronjobs/homedirs.php, 3 deb-specific/fileforge.pl, 4 deb-specific/groupdumpupdate.pl, 5 deb-specific/sshdumpupdate.pl, 6 deb-specific/userdumpupdate.pl, 7 plugins/scmbzr/common/BzrPlugin.class.php, 8 plugins/scmcvs/common/CVSPlugin.class.php, 9...

CVE-2013-10030

A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely...

CVE-2013-10022

A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrmdisplayform/cntctfrmcheckform of the file contactform.php. The manipulation leads to cross site scripting. The attack may be...

CVE-2013-10027

A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgradin...

CVE-2013-10021

A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely...