Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.

CVE-2013-4485NONECVSS 0.0EG 0.0

2013-11-23

389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.

CVE-2013-4494NONECVSS 0.0EG 0.0

2013-11-02

Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified…

CVE-2013-4535HIGHCVSS 8.8EG 8.8

2020-02-11

The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.

CVE-2013-4544NONECVSS 0.0EG 0.0

2014-05-08

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of …

CVE-2013-4549NONECVSS 0.0EG 0.0

2013-12-23

QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.

CVE-2013-4551NONECVSS 0.0EG 0.0

2013-11-18

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vector…

CVE-2013-4558NONECVSS 0.0EG 0.0

2013-12-07

The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers…

CVE-2013-4587NONECVSS 0.0EG 0.0

2013-12-14

Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.

CVE-2013-4615NONECVSS 0.0EG 0.0

2013-06-21

The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a di…

CVE-2013-4623NONECVSS 0.0EG 0.0

2013-09-30

The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop…

CVE-2013-4632NONECVSS 0.0EG 0.0

2013-06-20

The Huawei Access Router (AR) before V200R002SPC003 allows remote attackers to cause a denial of service (device reset) via a crafted field in a DHCP request, as demonstrated by a request from an IP phone.

CVE-2013-4636NONECVSS 0.0EG 0.0

2013-06-21

The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect…

CVE-2013-4673NONECVSS 0.0EG 0.0

2013-08-01

The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt.

CVE-2013-4710NONECVSS 0.0EG 0.0

2014-03-03

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial …

CVE-2013-4723NONECVSS 0.0EG 0.0

2014-04-25

Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL i…

CVE-2013-4751HIGHCVSS 8.1EG 8.1

2019-11-01

php-symfony2-Validator has loss of information during serialization

CVE-2013-4762NONECVSS 0.0EG 0.0

2013-08-20

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID.

CVE-2013-4768NONECVSS 0.0EG 0.0

2014-04-16

The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the "network connection clean up code" and (1) Cloud Controller (CLC), (2) Walrus, (3) Storage Controller (SC)…

CVE-2013-4788NONECVSS 0.0EG 0.0

2013-10-04

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers t…

CVE-2013-4811NONECVSS 0.0EG 0.0

2013-09-16

UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers…

CVE-2013-4812NONECVSS 0.0EG 0.0

2013-09-16

UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers t…

CVE-2013-4858NONECVSS 0.0EG 0.0

2013-12-30

Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a crafted .wav file, as demonstrated by movieMaker.wav.

CVE-2013-4912NONECVSS 0.0EG 0.0

2013-08-01

Open redirect vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by t…

CVE-2013-4924NONECVSS 0.0EG 0.0

2013-07-30

epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values, which allows remote attackers to cause a denial of service (assertion failure an…

CVE-2013-4926NONECVSS 0.0EG 0.0

2013-07-30

epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process, which allows remote attackers to cause a denial of…

CVE-2013-4930NONECVSS 0.0EG 0.0

2013-07-30

The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote att…

CVE-2013-4932NONECVSS 0.0EG 0.0

2013-07-30

Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a craft…

CVE-2013-4955NONECVSS 0.0EG 0.0

2013-08-20

Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter.

CVE-2013-5029NONECVSS 0.0EG 0.0

2013-08-19

phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.

CVE-2013-5045NONECVSS 0.0EG 0.0

2013-12-11

Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka "Internet Explorer Elevation of Privileg…

CVE-2013-5046NONECVSS 0.0EG 0.0

2013-12-11

Microsoft Internet Explorer 7 through 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka "Internet Explorer Elevation of Privi…

CVE-2013-5065HIGHCVSS 7.8EG 9.0⚠ KEV

2013-11-28

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

CVE-2013-5106HIGHCVSS 8.8EG 8.8

2020-02-12

A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.

CVE-2013-5140NONECVSS 0.0EG 0.0

2013-09-19

The kernel in Apple iOS before 7 allows remote attackers to cause a denial of service (assertion failure and device restart) via an invalid packet fragment.

CVE-2013-5152NONECVSS 0.0EG 0.0

2013-09-19

Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web site.

CVE-2013-5155NONECVSS 0.0EG 0.0

2013-09-19

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service (infinite loop) via an application that writes crafted values to /dev/random.

CVE-2013-5168NONECVSS 0.0EG 0.0

2013-10-24

Console in Apple Mac OS X before 10.9 allows user-assisted remote attackers to execute arbitrary applications by triggering a log entry with a crafted attached URL.

CVE-2013-5175NONECVSS 0.0EG 0.0

2013-10-24

The kernel in Apple Mac OS X before 10.9 allows local users to obtain sensitive information or cause a denial of service (out-of-bounds read and system crash) via a crafted Mach-O file.

CVE-2013-5192NONECVSS 0.0EG 0.0

2013-10-24

The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a request with a crafted (1) port or (2) port number.

CVE-2013-5211NONECVSS 0.0EG 9.0

2014-01-02

The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in …

CVE-2013-5220NONECVSS 0.0EG 0.0

2013-12-30

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device crash) via crafted HTTP POST data.

CVE-2013-5221NONECVSS 0.0EG 0.0

2013-09-24

The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.

CVE-2013-5350NONECVSS 0.0EG 0.0

2014-01-24

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, …

CVE-2013-5385NONECVSS 0.0EG 0.0

2014-01-02

The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, formerly BLADE Operating System) does not properly validate Link State Advertisement (LSA) type 1 packets before perform…

CVE-2013-5394NONECVSS 0.0EG 0.0

2013-10-16

The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to conduct phishing attacks via unspecified vectors.

CVE-2013-5407NONECVSS 0.0EG 0.0

2013-12-21

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web …

CVE-2013-5411NONECVSS 0.0EG 0.0

2013-12-21

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors.

CVE-2013-5431NONECVSS 0.0EG 0.0

2013-11-01

Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.1.1 before IF 15, 6.2.0 before IF 14, 6.2.1, and 6.2.2 before IF 8 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1 before IF 15, 6.2.0 befo…

CVE-2013-5462NONECVSS 0.0EG 0.0

2013-12-19

IBM/ECMClient/configure/explodedformat/navigator/header.jsp in IBM Content Navigator 2.0.0, 2.0.1 before 2.0.1.2-ICN-FP002, and 2.0.2 before 2.0.2.1-ICN-FP001 allows remote attackers to conduct clickjacking attacks via vectors involving FR…

CWE-20— Improper Input Validation

CVEs classified under CWE-20page 52 of 229

Map vulnerabilities like CWE-20 to your infrastructure