CVE-2013-2123

The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attacke...

CVE-2013-2123

The CVE-2013-2123 issue affects the Drupal module Node access user reference (nodeaccess_userreference) for Drupal 6.x-3.x (before 6.x-3.5) and Drupal 7.x-3.x (before 7.x-3.10). The root cause is inadequate access restriction for content containing a user reference field when author update/delete...

CVE-2013-4039

CVE-2013-4039 affects IBM WebSphere Extended Deployment Compute Grid 8.0, prior to 8.0.0.3. A remote authenticated attacker could obtain sensitive information and bypass job access restrictions via unspecified vectors. IBM/Security bulletins indicate remediation by applying Fix Pack 3 (8.0.0.3) o...

CVE-2013-3370

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

Cross site request forgery (csrf)

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

CVE-2013-3370

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

CVE-2013-3370

CVE-2013-3370 affects Request Tracker (RT) 3.8.x prior to 3.8.17 and 4.0.x prior to 4.0.13. The flaw is failure to properly restrict access to private callback components, allowing remote attackers to trigger an unspecified impact via a direct request. The connected documents consistently describ...

CVE-2013-4230

The mm_webform submodule in Monster Menus (Drupal 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13) does not properly restrict access to webform submissions, allowing remote authenticated users with the “Who can read data submitted to this webform” permission to delete arbitrary submissions vi...

CVE-2013-4230

The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...

CVE-2013-5097

Juniper Junos Space before 13.1R1.6 (JA1500 and other contexts) exposes the list of user accounts and their MD5 password hashes due to improper access restriction, enabling remote authenticated users to obtain sensitive information via a dictionary attack. Affected are Junos Space deployments pri...

PineApp Mail-SeCure ldapsyncnow.php command injection

Added: 08/14/2013 BID: 61474 OSVDB: 95781 Background PineApp Mail-SeCure is an e-mail security appliance which provides perimeter security protection to stop threats prior to their penetration of the customer's network, as well as post-perimeter anti-spam content inspection. Problem A vulnerabili...

PineApp Mail-SeCure test_li_connection.php Command Injection

Added: 08/08/2013 BID: 61477 OSVDB: 95782 Background PineApp Mail-SeCure is an e-mail security appliance which provides perimeter security protection to stop threats prior to their penetration of the customer's network, as well as post-perimeter anti-spam content inspection. Problem PineApp...

CVE-2013-1717

CVE-2013-1717: Local-filesystem access via Java applets not properly restricted in Mozilla Firefox (before 23.0; ESR 17.x before 17.0.8), SeaMonkey (before 2.20), and Thunderbird (before 17.0.8). This allows user‑assisted reading of arbitrary files through downloads to fixed/predictable paths. Co...

DEBIAN-CVE-2013-2219

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute...

Design/Logic Flaw

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute...

CVE-2013-2219

The CVE affects Red Hat Directory Server and its open source equivalent, 389 Directory Server. The root cause is improper enforcement of access controls for attributes during search filter evaluation, enabling remote authenticated users to retrieve values of restricted attributes via a query. The...

CVE-2013-2219

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute...

Design/Logic Flaw

mod/chat/guisockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access...

WordPress I Love It Theme <= 1.9 Multiple Vulnerabilities - Active Check

The WordPress theme SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cosmothemes:iloveit"; ifdescription...

CVE-2013-2242

Summary: CVE-2013-2242 affects Moodle versions up to 2.5.x, where the chat daemon could be accessed by remote authenticated users due to insufficient checks on mod/chat:chat capability before authorizing daemon-mode chat. This could bypass intended access restrictions via an HTTP session to a cha...