Filtered by vendor Subscriptions
Total 323399 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2013-7469 1 Seafile 1 Seafile 2024-11-21 N/A
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2013-7468 1 Simplemachines 1 Simple Machines Forum 2024-11-21 N/A
Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter.
CVE-2013-7467 1 Simplemachines 1 Simple Machines Forum 2024-11-21 N/A
Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
CVE-2013-7466 1 Simplemachines 1 Simple Machines Forum 2024-11-21 N/A
Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the db_type parameter if install.php remains present after installation.
CVE-2013-7465 1 Icecoldapps 1 Servers Ultimate 2024-11-21 N/A
Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute arbitrary code by uploading PHP scripts.
CVE-2013-7464 1 Csrf-magic Project 1 Csrf-magic 2024-11-21 N/A
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
CVE-2013-7435 1 Evergreen-ils 1 Evergreen 2024-11-21 N/A
The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fm_IDL.xml.
CVE-2013-7390 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 9.8 Critical
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.
CVE-2013-7381 1 Libnotify Project 1 Libnotify 2024-11-21 9.8 Critical
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
CVE-2013-7380 1 Ep Imageconvert Project 1 Ep Imageconvert 2024-11-21 9.8 Critical
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
CVE-2013-7378 1 Hubot Scripts Project 1 Hubot Scripts 2024-11-21 9.8 Critical
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
CVE-2013-7371 2 Debian, Sencha 2 Debian Linux, Connect 2024-11-21 6.1 Medium
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
CVE-2013-7370 4 Debian, Opensuse, Redhat and 1 more 4 Debian Linux, Opensuse, Openshift and 1 more 2024-11-21 6.1 Medium
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
CVE-2013-7351 1 Shaarli Project 1 Shaarli 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS, (2) showATOM, or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.
CVE-2013-7333 1 Projectfloodlight 1 Open Sdn Controller 2024-11-21 7.5 High
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect individual switches from the SDN controller, causing degradation and eventually denial of network access to all devices connected to the targeted switch.
CVE-2013-7325 1 Debian 2 Debian Linux, Devscripts 2024-11-21 8.8 High
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
CVE-2013-7324 1 Webkitgtk 1 Webkitgtk 2024-11-21 5.3 Medium
Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound volume via malicious javascript. NOTE: this WebKit-GTK behavior complies with existing W3C standards and existing practices for GNOME desktop integration.
CVE-2013-7287 1 Mobileiron 2 Sentry, Virtual Smartphone Platform 2024-11-21 9.8 Critical
MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
CVE-2013-7286 1 Att 2 Mobileiron Sentry, Mobileiron Virtual Smartphone Platform 2024-11-21 7.5 High
MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
CVE-2013-7245 1 Sybase 1 Adaptive Server Enterprise 2024-11-21 N/A
The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859.