CVE-2013-2200

WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors...

Code injection

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to upload arbitrary files via unspecified vectors...

CVE-2013-3020

CVE-2013-3020 is an Information Disclosure vulnerability in IBM Sterling B2B Integrator (versions 5.1/5.2/5.0) and IBM Sterling File Gateway (versions 2.1/2.2/2.0). The IBM bulletin attributes this to disclosure of application implementation details via unspecified vectors. Affected products/vers...

CVE-2013-2983

CVE-2013-2983 is an XSS vulnerability affecting IBM Sterling B2B Integrator (versions 5.0–5.2) and IBM Sterling File Gateway (versions 2.0–2.2). The cross-site scripting flaw could allow a remote authenticated user to inject arbitrary web script or HTML via unspecified vectors. The connected IBM ...

Design/Logic Flaw

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

Design/Logic Flaw

HP SQL/MX 3.2 and earlier on NonStop servers, when SQL/MP Objects are used, allows remote authenticated users to obtain sensitive information via unspecified vectors, aka the "SQL/MP index" issue...

Foreman: app/controllers/users_controller.rb arbitrary admin user creation due to mass assignment

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

CVE-2013-1393

Cross-site scripting XSS vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors...

RUCKUS ADVISORY ID 031813-2: User authentication bypass vulnerability in ZoneDirector administrative web interface

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 031813-2 Customer release date: March 25, 2013 Public release date: May 27, 2013 TITLE User authentication bypass vulnerability in ZoneDirector administrative web interface SUMMARY An user authentication bypass vulnerability has bee...

CVE-2013-3959

The CVE-2013-3959 issue affects Siemens WinCC Web Navigator (before 7.2 Update 1, used in SIMATIC PCS7 8.0 SP1 and earlier). The root cause is improper handling of NetBIOS user name checks via crafted URL parameters, allowing remote authenticated users to enumerate valid user names (forced browsi...

CVE-2013-3576

CVE-2013-3576 affects HP System Management Homepage (SMH); ginkgosnmp.inc uses the last URL path segment in an exec call, enabling remote authenticated users to execute arbitrary commands via PATH_INFO (e.g., snmhutil/snmpchp.php.en). Impact: remote code execution with full privileges on the HP S...

CVE-2013-1339

The Print Spooler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly manage memory during deletion of printer connections, which allows remote authenticated users to execute arbitrary code via a craft...

PT-2013-3094 · Microsoft · Windows Vista Sp2 +7

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT Description: The issue is related to the Print Spooler in Microsoft Window...

MySQL Server Optimizer Component Unspecified Vulnerability

MySQL is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mysql:mysql"; ifdescription...

CVE-2013-0578

The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8.0 before HF128 and IBM Sterling Selling and Fulfillment Foundation 8.5 before HF93, 9.0 before HF73, 9.1.0 before FP45, and 9.2.0 before FP17, when the API tester is enabled, do not require administrative...

CVE-2013-2308

CVE-2013-2308 affects SoftBank Online Service Gate components: the OWA Helper and OSG Lite . The vulnerability allows remote authenticated users to obtain their own Office 365 passwords, thereby bypassing a platform restriction, via unspecified vectors. This is documented in multiple sources (NVD...

CVE-2013-3510

Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via 1 nedi/html/System-Export.php, 2 nedi/html/Devices-List.php, or 3 the Noma component...

Directory traversal

Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to overwrite arbitrary files by leveraging access to the nagios account...

Design/Logic Flaw

html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing...

CVE-2013-3507

The CVE-2013-3507 issue affects GroundWork Monitor Enterprise 6.7.0 via the NeDi component. The vulnerability allows remote authenticated users to disclose sensitive information by directly requesting one of three resources: (1) a configuration file, (2) a database dump, or (3) the Tomcat status ...