CVEs published April 9, 2013
31 CVEs were published on April 9, 2013: 0 critical, 2 high.
- Published
- 31
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- crack
- 1
- extlib
- 1
- httparty
- 1
- newrelic_rpm
- 1
- nori
- 1
- omniauth-oauth2
- 1
- org.jruby:jruby
- 1
- thumbshooter
- 1
High 2
- CVE-2013-1292Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 G
- CVE-2013-1294Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, a
Medium, low and unrated 29
- CVE-2013-0078The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows lo
- CVE-2013-1282The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD
- CVE-2013-1283Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win
- CVE-2013-1284Race condition in the kernel in Microsoft Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted
- CVE-2013-1289Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, an
- CVE-2013-1290Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls f
- CVE-2013-1291win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Wind
- CVE-2013-1293The NTFS kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local
- CVE-2013-1295The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 does not p
- CVE-2013-1296The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects
- CVE-2013-1303Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web
- CVE-2013-1304Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web
- CVE-2013-1821lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption andorg.jruby:jruby
- CVE-2012-5635The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitra
- CVE-2012-6097File descriptor leak in cronie 1.4.8, when running in certain environments, might allow local users to read restricted files, as demonstrate
- CVE-2012-6134Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the omniauth-oauth2
- CVE-2013-0253The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers
- CVE-2013-0284Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackernewrelic_rpm
- CVE-2013-0285The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, whicnori
- CVE-2013-1788poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vector
- CVE-2013-1789splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and cras
- CVE-2013-1790poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read
- CVE-2013-1800The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct obcrack
- CVE-2013-1801The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conducthttparty
- CVE-2013-1802The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct extlib
- CVE-2013-1898lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters inthumbshooter
- CVE-2013-0134Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via
- CVE-2013-0135Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id paramet
- CVE-2013-2778Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to