CVEs published October 28, 2013
28 CVEs were published on October 28, 2013: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- apache-solr-for-typo3/solr
- 2
- commons-fileupload:commons-fileupload
- 1
Medium, low and unrated 28
- CVE-2010-1159Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbit
- CVE-2012-0825Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers
- CVE-2012-0826Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attacke
- CVE-2012-0827The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary
- CVE-2012-6303Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4,
- CVE-2013-2208tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.
- CVE-2013-3243Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors.
- CVE-2013-3704The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a r
- CVE-2013-4391Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of servi
- CVE-2013-4392systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via
- CVE-2013-4393journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blo
- CVE-2013-4394The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Exte
- CVE-2013-4402The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infi
- CVE-2013-5744Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML
- CVE-2013-6012Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle c
- CVE-2013-6014Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 be
- CVE-2013-6288Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors,apache-solr-for-typo3/solr
- CVE-2013-6289Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to injapache-solr-for-typo3/solr
- CVE-2012-4529The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE,
- CVE-2012-4572Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom
- CVE-2013-1056X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges
- CVE-2013-2102The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups
- CVE-2013-2186The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hcommons-fileupload:commons-fileupload
- CVE-2013-5430The Jazz Team Server component in IBM Security AppScan Enterprise 8.x before 8.8 has a default username and password, which makes it easier
- CVE-2013-6018Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the aut
- CVE-2013-6019Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTM
- CVE-2013-6020passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depen
- CVE-2013-6285The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-st