CVE-2013-2237: Improper Restriction of Operations within the Bounds of a Memory Buffer

The keynotifypolicyflush function in net/key/afkey.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notifypolicy interface of an IPSec keysocket...

CVE-2013-1695: Undefined Security Weakness

Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element...

CVE-2013-0534: Undefined Security Weakness

The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory...

CVE-2013-3743: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT...

CVE-2013-2459: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE...

CVE-2013-1095: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management ZCM 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event...

CVE-2013-1986: Undefined Security Weakness

Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XRRQueryOutputProperty and 2 XRRQueryProviderProperty functions...

CVE-2013-1982: Undefined Security Weakness

Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XcupGetReservedColormapEntries, 2 XcupStoreColors, 3 XdbeGetVisualInfo, 4 XeviGetVisualInfo, 5 XShapeGetRectangles, and 6...

CVE-2013-1993: Undefined Security Weakness

Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XF86DRIOpenConnection and 2 XF86DRIGetClientDriverName functions...

CVE-2013-1981: Undefined Security Weakness

Multiple integer overflows in X.org libX11 1.5.99.901 1.6 RC1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XQueryFont, 2 XF86BigfontQueryFont, 3 XListFontsWithInfo, 4 XGetMotionEvents, 5 XListHosts, 6...

CVE-2013-2064: Undefined Security Weakness

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the readpacket function...

CVE-2013-2337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HP Service Manager 7.11, 9.21, 9.30, and 9.31, and ServiceCenter 6.2.8, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3574: Improper Input Validation

Absolute path traversal vulnerability in hpdiags/frontend2/commands/saveCompareConfig.php in HP Insight Diagnostics 9.4.0.4710 allows remote attackers to write data to arbitrary files via a full pathname in the argument to the devicePath aka mount parameter...

CVE-2013-2317: Undefined Security Weakness

The Sleipnir Mobile application 2.9.1 and earlier and Sleipnir Mobile Black Edition application 2.9.1 and earlier for Android allow remote attackers to spoof the address bar via vectors involving the opening of a new window...

CVE-2013-0136: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service file deletion or renaming via 1 the uploadPath parameter...

CVE-2013-1962: Undefined Security Weakness

The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service file descriptor consumption via a large number of requests "to list all volumes for the particular pool."...

CVE-2013-3557: Improper Restriction of Operations within the Bounds of a Memory Buffer

The dissectberchoice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service application crash via a malformed packet...

CVE-2013-1015: Improper Restriction of Operations within the Bounds of a Memory Buffer

Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted TeXML file...

CVE-2013-3634: Improper Input Validation

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants Versions V5.0.0 for CVE-2013-3633 and versions V4.5.0 for CVE-2013-3634, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.1.0. The implementation of SNMPv3 does not check the use...

CVE-2013-0997: Undefined Security Weakness

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in...

CVE-2013-0998: Undefined Security Weakness

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in...

CVE-2013-2737: Exposure of Sensitive Information to an Unauthorized Actor

A JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to obtain sensitive information via unspecified vectors...

CVE-2013-1175: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This issue was announced by the vendor and later withdrawn because it was not a vulnerability. Notes: none...

CVE-2013-1188: Improper Authentication

Cisco Unified Communications Manager CUCM does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service application slowdown via a series of requests, aka Bug ID CSCud39515...

CVE-2013-1678: Improper Restriction of Operations within the Bounds of a Memory Buffer

The cairoxlibsurfaceaddglyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service invalid write operation via unspecified vectors...

CVE-2013-1307: Use After Free

Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-0811...

CVE-2013-1225: Undefined Security Weakness

Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager 1 HTTP or 2 HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka...

CVE-2013-1234: Improper Restriction of Operations within the Bounds of a Memory Buffer

The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service process restart via crafted SNMP packets, aka Bug ID CSCue69472...

CVE-2013-1231: Improper Input Validation

The HTTP implementation in Cisco WebEx Node for MCS and WebEx Meetings Server allows remote attackers to read cache files via a crafted request, aka Bug IDs CSCue36664 and CSCue36629...

CVE-2012-0864: Undefined Security Weakness

Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFYSOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments...

CVE-2013-1158: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the IBM Tivoli Monitoring ITM help menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud54397...

CVE-2012-4952: Undefined Security Weakness

Henry Schein Dentrix G5 before 15.1.294 has a single internal-database password that is shared across different customers' installations, which allows remote attackers to obtain sensitive information about patients by leveraging knowledge of this password from another installation...

CVE-2013-0666: Undefined Security Weakness

The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service unhandled exception and application crash via a TCP RST packet...

CVE-2013-3302: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the smbsendrqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact via vectors involving a reconnection event...

CVE-2013-1198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a Flash component in Cisco Unified Computing System UCS Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430...

CVE-2013-1926: Undefined Security Weakness

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet...

CVE-2012-5948: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 WebProcess.srv, 2 the html/en/default/ directory, 3 Widget/resource, 4 birt/frameset, or 5...

CVE-2013-3235: Exposure of Sensitive Information to an Unauthorized Actor

net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call...

CVE-2013-2384: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors relate...

CVE-2013-1536: Undefined Security Weakness

Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.05 and 6.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security...

CVE-2013-2416: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment...

CVE-2013-2402: Undefined Security Weakness

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect integrity via unknown vectors related to WorkCenter...

CVE-2013-1510: Undefined Security Weakness

Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0419...

CVE-2013-2421: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the...

CVE-2013-2426: Undefined Security Weakness

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from t...

CVE-2013-0413: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Remote Execution Service...

CVE-2013-0408: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to CPU performance counters drivers...

CVE-2013-2403: Undefined Security Weakness

Unspecified vulnerability in the Siebel Enterprise Application Integration component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Services, a different vulnerability than CVE-2013-0416...

CVE-2013-1385: Undefined Security Weakness

Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors...

CVE-2013-0664: Undefined Security Weakness

The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests...