CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-3537 89 Exec Code Sql 2013-05-13 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_post or (2) pg parameter.
2 CVE-2013-3536 89 1 Exec Code Sql 2013-05-13 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
3 CVE-2013-3533 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Virtual Access Monitor 3.10.17 and earlier allow attackers to execute arbitrary SQL commands via unspecified vectors.
4 CVE-2013-3532 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for Drupal allows remote attackers to execute arbitrary SQL commands via the theme parameter.
5 CVE-2013-3531 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
6 CVE-2013-3530 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
7 CVE-2013-3528 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."
8 CVE-2013-3527 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
9 CVE-2013-3525 89 Exec Code Sql 2013-05-10 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims."
10 CVE-2013-3524 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter. NOTE: this was originally reported as a problem in phpVMS.
11 CVE-2013-3523 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in This HTML Is Simple (THIS) before 1.2.4 allows remote to execute arbitrary SQL commands via unspecified vectors.
12 CVE-2013-3506 264 Exec Code 2013-05-08 2013-05-08
7.5
 None Remote Low Not required Partial Partial Partial
cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.
13 CVE-2013-3500 264 Bypass 2013-05-08 2013-05-08
7.5
 None Remote Low Not required Partial Partial Partial
The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.
14 CVE-2013-3499 264 2013-05-08 2013-05-08
7.5
 None Remote Low Not required Partial Partial Partial
GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which allows remote attackers to obtain administrative privileges or access files via a crafted header.
15 CVE-2013-3301 DoS 2013-04-29 2013-04-29
7.2
 None Local Low Not required Complete Complete Complete
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.
16 CVE-2013-3266 20 DoS Exec Code Mem. Corr. 2013-05-02 2013-05-02
7.5
 None Remote Low Not required Partial Partial Partial
The nfsrvd_readdir function in sys/fs/nfsserver/nfs_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify that a READDIR request is for a directory node, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by specifying a plain file instead of a directory.
17 CVE-2013-3050 89 1 Exec Code Sql 2013-04-12 2013-04-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
18 CVE-2013-2780 119 DoS Overflow 2013-04-21 2013-04-22
7.8
 None Remote Low Not required None None Complete
Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to UDP port 161 (aka the SNMP port).
19 CVE-2013-2779 20 DoS 2013-04-11 2013-04-11
7.8
 None Remote Low Not required None None Complete
Cisco IOS XE 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 MVPN (aka MVPNv6) packets, aka Bug ID CSCub34945, a different vulnerability than CVE-2013-1164.
20 CVE-2013-2778 352 CSRF 2013-04-08 2013-04-09
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentication of administrators for requests that delete accounts, a different vulnerability than CVE-2013-0135.1.
21 CVE-2013-2743 287 Bypass 2013-04-02 2013-04-02
7.5
 None Remote Low Not required Partial Partial Partial
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
22 CVE-2013-2742 2013-04-02 2013-04-02
7.5
 None Remote Low Not required Partial Partial Partial
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
23 CVE-2013-2741 287 +Info 2013-04-02 2013-04-02
7.5
 None Remote Low Not required Partial Partial Partial
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
24 CVE-2013-2690 89 1 Exec Code Sql 2013-03-28 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.
25 CVE-2013-2685 119 Exec Code Overflow 2013-04-01 2013-04-02
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.
26 CVE-2013-2617 94 Exec Code 2013-03-20 2013-03-21
7.5
 None Remote Low Not required Partial Partial Partial
lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
27 CVE-2013-2616 94 Exec Code 2013-03-20 2013-03-21
7.5
 None Remote Low Not required Partial Partial Partial
lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
28 CVE-2013-2615 94 Exec Code 2013-03-20 2013-03-21
7.5
 None Remote Low Not required Partial Partial Partial
lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
29 CVE-2013-2560 22 Dir. Trav. 2013-03-15 2013-03-20
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in the web interface on Foscam devices with firmware before 11.37.2.49 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by discovering (1) web credentials or (2) Wi-Fi credentials.
30 CVE-2013-2557 119 DoS Overflow Mem. Corr. 2013-03-11 2013-03-16
7.5
 None Remote Low Not required Partial Partial Partial
The sandbox protection mechanism in Microsoft Internet Explorer 9 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, as demonstrated against Adobe Flash Player by VUPEN during a Pwn2Own competition at CanSecWest 2013.
31 CVE-2013-2556 Bypass 2013-03-11 2013-03-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Microsoft Windows 7 allows attackers to bypass the ASLR protection mechanism via unknown vectors, as demonstrated against Adobe Flash Player by VUPEN during a Pwn2Own competition at CanSecWest 2013.
32 CVE-2013-2554 Bypass 2013-03-11 2013-03-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Microsoft Windows 7 allows attackers to bypass the ASLR and DEP protection mechanisms via unknown vectors, as demonstrated against Firefox by VUPEN during a Pwn2Own competition at CanSecWest 2013, a different vulnerability than CVE-2013-0787.
33 CVE-2013-2553 +Priv 2013-03-11 2013-03-16
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in the kernel in Microsoft Windows 7 allows local users to gain privileges via unknown vectors, as demonstrated by Nils and Jon of MWR Labs during a Pwn2Own competition at CanSecWest 2013, a different vulnerability than CVE-2013-0912.
34 CVE-2013-2552 Bypass 2013-03-11 2013-03-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Microsoft Internet Explorer 10 on Windows 8 allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a Medium integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
35 CVE-2013-2550 Bypass 2013-03-11 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe Reader 11.0.02 allows attackers to bypass the sandbox protection mechanism via unknown vectors, as demonstrated by George Hotz during a Pwn2Own competition at CanSecWest 2013.
36 CVE-2013-2549 94 Exec Code 2013-03-11 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe Reader 11.0.02 allows remote attackers to execute arbitrary code via vectors related to a "break into the sandbox," as demonstrated by George Hotz during a Pwn2Own competition at CanSecWest 2013.
37 CVE-2013-2496 119 DoS Overflow 2013-03-09 2013-04-10
7.5
 None Remote Low Not required Partial Partial Partial
The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.
38 CVE-2013-2495 189 DoS Overflow 2013-03-09 2013-04-10
7.5
 None Remote Low Not required Partial Partial Partial
The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.
39 CVE-2013-2430 2013-04-17 2013-04-18
7.6
 None Remote High Not required Complete Complete Complete
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO.
40 CVE-2013-2429 2013-04-17 2013-04-18
7.6
 None Remote High Not required Complete Complete Complete
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO.
41 CVE-2013-2394 2013-04-17 2013-04-18
7.6
 None Remote High Not required Complete Complete Complete
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2432 and CVE-2013-1491.
42 CVE-2013-2292 399 DoS 2013-03-12 2013-03-18
7.8
 None Remote Low Not required None None Complete
bitcoind and Bitcoin-Qt 0.8.0 and earlier allow remote attackers to cause a denial of service (electricity consumption) by mining a block to create a nonstandard Bitcoin transaction containing multiple OP_CHECKSIG script opcodes.
43 CVE-2013-2279 20 +Priv 2013-03-21 2013-03-22
7.5
 None Remote Low Not required Partial Partial Partial
CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain privileges.
44 CVE-2013-2277 DoS 2013-02-27 2013-04-10
7.5
 None Remote Low Not required Partial Partial Partial
The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.
45 CVE-2013-2276 DoS 2013-02-27 2013-02-27
7.5
 None Remote Low Not required Partial Partial Partial
The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted audio data.
46 CVE-2013-2268 2013-02-23 2013-02-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, has unknown impact and remote attack vectors, related to a "high severity security issue."
47 CVE-2013-2266 119 DoS Overflow 2013-03-28 2013-04-10
7.8
 None Remote Low Not required None None Complete
libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.
48 CVE-2013-2094 189 +Priv 2013-05-14 2013-05-14
7.2
 None Local Low Not required Complete Complete Complete
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
49 CVE-2013-2017 399 DoS 2013-05-03 2013-05-03
7.8
 None Remote Low Not required None None Complete
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
50 CVE-2013-1969 399 DoS Exec Code Overflow 2013-04-25 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.