CVE-2013-5688

Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via a ../%00 dot dot backslash encoded null byte in the file parameter in a 1 download or 2 getcontent action, or 3 upload arbitrary files via a ../%0...

CVE-2013-5769

Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 allows remote authenticated users to affect availability via unknown vectors related to Web Services...

CVE-2013-5551

Cisco Adaptive Security Appliance ASA Software, when certain same-security-traffic and management-access options are enabled, allows remote authenticated users to cause a denial of service stack overflow and device reload by using the clientless SSL VPN portal for internal-resource browsing, aka...

CVE-2013-5539

The upload-dialog implementation in Cisco Identity Services Engine ISE allows remote authenticated users to upload files with an arbitrary file type, and consequently conduct attacks against unspecified other systems, via a crafted file, aka Bug ID CSCui67511...

CVE-2013-1611

Multiple cross-site scripting XSS vulnerabilities in administrative-interface pages in the management console in Symantec Brightmail Gateway 9.5.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1648

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated b...

CVE-2013-1887

Multiple cross-site scripting XSS vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields...

CVE-2013-1645

Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. dot dot in the publication template path...

CVE-2013-1829

calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role...

CVE-2013-1814

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

CVE-2013-2360

Unspecified vulnerability in HP System Management Homepage SMH before 7.2.1 allows remote authenticated users to cause a denial of service via unknown vectors, a different vulnerability than CVE-2013-2357, CVE-2013-2358, and CVE-2013-2359...

CVE-2013-2299

Cross-site scripting XSS vulnerability in Advantech WebAccess formerly BroadWin WebAccess before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4465

Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecifie...

CVE-2013-4633

Huawei Seco Versatile Security Manager VSM before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting...

CVE-2013-4821

Unspecified vulnerability in HP System Management Homepage SMH before 7.2.1 allows remote authenticated users to cause a denial of service via unknown vectors...

CVE-2013-4790

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

CVE-2013-0669

The HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to cause a denial of service daemon crash via a crafted HTTP request...

CVE-2013-0136

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service file deletion or renaming via 1 the uploadPath parameter...

CVE-2013-3056

Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors...