CVE-2013-3868: Improper Input Validation

Microsoft Active Directory Lightweight Directory Service AD LDS on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 and Active Directory Services on Windows Server 2008 SP2 and R2 SP1 and Server 2012 allow remote attackers to cause a denial of service LDAP...

CVE-2013-3155: Improper Restriction of Operations within the Bounds of a Memory Buffer

Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted Access file, aka "Access Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3157...

CVE-2013-2794: Improper Restriction of Operations within the Bounds of a Memory Buffer

Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service infinite loop via crafted input over a serial line...

CVE-2013-1117: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the exception handler in Cisco WebEx Recording Format WRF player T27 LD before SP32 EP16, T27 L10N before SP32ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted WRF file, aka Bug ID...

CVE-2012-6591: Improper Neutralization of Special Elements used in an OS Command

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116...

CVE-2012-6605: Improper Neutralization of Special Elements used in an OS Command

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896...

CVE-2013-3472: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Enterprise License Manager ELM in Cisco Unified Communications Manager CM allows remote attackers to hijack the authentication of arbitrary users for requests that make ELM modifications, aka Bug ID CSCui58210...

CVE-2013-2195: Undefined Security Weakness

The Elf parser libelf in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations...

CVE-2013-5569: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2194: Undefined Security Weakness

Multiple integer overflows in the Elf parser libelf in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel...

CVE-2013-5320: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers to inject arbitrary web script or HTML via the txtSubject parameter...

CVE-2013-5309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in install/forumdata/src/customfields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from...

CVE-2013-5121: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PHPFox before 3.6.0 build6 allows remote attackers to execute arbitrary SQL commands via the searchsortby parameter to user/browse/view/...

CVE-2013-4124: Undefined Security Weakness

Integer overflow in the readnttransealist function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service memory consumption via a malformed packet...

CVE-2013-1616: Improper Neutralization of Special Elements used in an OS Command

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...

CVE-2013-4954: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 pass1 or 2 pass2...

CVE-2013-4925: Undefined Security Weakness

Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service assertion failure and daemon exit via a crafted packet...

CVE-2013-0723: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in etxrw.dll in Kingsoft Spreadsheets 2012 8.1.0.3030 allow remote attackers to cause a denial of service memory corruption and crash or possibly execute arbitrary code via a crafted spreadsheet file...

CVE-2013-4928: Undefined Security Weakness

Integer signedness error in the dissectheaders function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service infinite loop via a crafted packet...

CVE-2012-3414: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the...

CVE-2013-2028: Out-of-bounds Write

The ngxhttpparsechunked function in http/ngxhttpparse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service crash and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based...

CVE-2013-1218: Improper Restriction of Operations within the Bounds of a Memory Buffer

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

CVE-2013-3798: Undefined Security Weakness

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote attackers to affect integrity and availability via unknown vectors related to MemCached...

CVE-2013-3770: Undefined Security Weakness

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1, 11.1.1.6.0, and 11.1.1.7.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Content Server. NOTE: the previous information is from th...

CVE-2013-2874: Undefined Security Weakness

Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access to screen data via vectors involving IPC transmission of GL textures...

CVE-2013-3163: Out-of-bounds Write

Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151...

CVE-2013-2053: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be...

CVE-2013-2237: Improper Restriction of Operations within the Bounds of a Memory Buffer

The keynotifypolicyflush function in net/key/afkey.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notifypolicy interface of an IPSec keysocket...

CVE-2013-0476: Undefined Security Weakness

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors...

CVE-2013-2983: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM Sterling File Gateway 2.2 and Sterling B2B Integrator allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2013-0468...

CVE-2013-3028: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple buffer overflows in mqm programs in IBM WebSphere MQ 7.0.x before 7.0.1.11, 7.1.x before 7.1.0.3, and 7.5.x before 7.5.0.2 on non-Windows platforms allow local users to gain privileges via unspecified vectors...

CVE-2013-1695: Undefined Security Weakness

Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element...

CVE-2013-2459: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE...

CVE-2013-1095: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management ZCM 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event...

CVE-2013-2064: Undefined Security Weakness

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the readpacket function...

CVE-2013-1993: Undefined Security Weakness

Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XF86DRIOpenConnection and 2 XF86DRIGetClientDriverName functions...

CVE-2013-2337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HP Service Manager 7.11, 9.21, 9.30, and 9.31, and ServiceCenter 6.2.8, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3574: Improper Input Validation

Absolute path traversal vulnerability in hpdiags/frontend2/commands/saveCompareConfig.php in HP Insight Diagnostics 9.4.0.4710 allows remote attackers to write data to arbitrary files via a full pathname in the argument to the devicePath aka mount parameter...

CVE-2013-2317: Undefined Security Weakness

The Sleipnir Mobile application 2.9.1 and earlier and Sleipnir Mobile Black Edition application 2.9.1 and earlier for Android allow remote attackers to spoof the address bar via vectors involving the opening of a new window...

CVE-2013-0136: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service file deletion or renaming via 1 the uploadPath parameter...

CVE-2013-1962: Undefined Security Weakness

The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service file descriptor consumption via a large number of requests "to list all volumes for the particular pool."...

CVE-2013-3557: Improper Restriction of Operations within the Bounds of a Memory Buffer

The dissectberchoice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service application crash via a malformed packet...

CVE-2013-3634: Improper Input Validation

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants Versions V5.0.0 for CVE-2013-3633 and versions V4.5.0 for CVE-2013-3634, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.1.0. The implementation of SNMPv3 does not check the use...

CVE-2013-0998: Undefined Security Weakness

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in...

CVE-2013-1004: Undefined Security Weakness

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in...

CVE-2013-1188: Improper Authentication

Cisco Unified Communications Manager CUCM does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service application slowdown via a series of requests, aka Bug ID CSCud39515...

CVE-2013-1678: Improper Restriction of Operations within the Bounds of a Memory Buffer

The cairoxlibsurfaceaddglyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service invalid write operation via unspecified vectors...

CVE-2013-1307: Use After Free

Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-0811...

CVE-2013-2094: Undefined Security Weakness

The perfsweventinit function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perfeventopen system call...

CVE-2013-1225: Undefined Security Weakness

Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager 1 HTTP or 2 HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka...