CVE archive

December 2013

Browse CVE records published in December 2013, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEs Known exploited

Showing 47 of 547 matching CVEs · Page 11 of 11.

Unknown · CVSS Not scored

CVE-2013-2166: python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

Published Dec 10, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2133: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platf...

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Published Dec 6, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2106: webauth before 4.6.1 has authentication credential disclosure

webauth before 4.6.1 has authentication credential disclosure

Published Dec 3, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2167: python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass

Published Dec 10, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2095: rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.pras...

rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection

Published Dec 10, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2103: OpenShift cartridge allows remote URL retrieval

OpenShift cartridge allows remote URL retrieval

Published Dec 3, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2101: Katello has multiple XSS issues in various entities

Katello has multiple XSS issues in various entities

Published Dec 3, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2030: keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary...

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Published Dec 27, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1953: Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-depend...

Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.

Published Dec 9, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1978: Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in i...

Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries.

Published Dec 12, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2016: A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the...

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

Published Dec 30, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-2011: WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow...

WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009.

Published Dec 26, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1913: Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9...

Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries value in an X Window System (XWD) image dump.

Published Dec 12, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1812: The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU...

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

Published Dec 12, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1793: openstack-utils openstack-db has insecure password creation

openstack-utils openstack-db has insecure password creation

Published Dec 10, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1689: Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to...

Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.

Published Dec 10, 2019 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1447: OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash)...

OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash) via unspecified vectors related to NULL pointer dereferences, division-by-zero, and other errors.

Published Dec 12, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1430: An issue was discovered in xrdp before 0.9.1.

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.

Published Dec 16, 2016 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1349: Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbi...

Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.

Published Dec 9, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1364: The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override...

The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.

Published Dec 14, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1090: The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and dir...

The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.

Published Dec 6, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-1096: Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D...

Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.

Published Dec 28, 2013 · Updated Aug 6, 2024

Unknown · CVSS Not scored

CVE-2013-0858: The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to ha...

The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.