13124 matches found
Code injection
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors...
CVE-2013-1813
CVE-2013-1813 affects BusyBox where util-linux/mdev.c creates intermediate /dev/ directories with 0777 permissions when nesting (/dev/dir1/dir2/...), allowing local users to exploit the improper permission handling. The linked Nessus/OpenVAS entries (e.g., MiracleLinux AXSA advisory referencing B...
CVE-2013-1813
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors...
busybox: insecure directory permissions in /dev
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors...
CVE-2013-6823
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors...
Xxe
GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity XXE issue...
Unrestricted file upload
Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure NWDI allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors...
CVE-2013-5966
Cross-site scripting XSS vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2013-6822
CVE-2013-6822 affects the SAP NetWeaver component GRMGApp and is tied to an XML External Entity (XXE) issue. The available description states a remote impact but does not specify exact vulnerable versions, attack vectors, or concrete remediation. Several connected records reference SAP advisories...
Design/Logic Flaw
Use-after-free vulnerability in the Channel::SendRTCPPacket function in voiceengine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other...
CVE-2013-6632
Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit GWT before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2013-4555
Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...
CVE-2013-4551
Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for 1 VMLAUNCH and 2 VMRESUME, which allows local HVM guest users to cause a denial of service host crash via unspecified vectors related to "guest VMX instruction execution."...
flash-plugin: multiple code execution flaws (APSB13-26)
Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, Adobe AIR before 3.9.0.1210, Adobe AIR SDK before 3.9.0.1210, and Adobe AIR SDK & Compiler before 3.9.0.1210 allow attackers to execute arbitrary code or caus...
Code injection
Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors...