PUBLIÉES EN

octobre 2013

634 CVE, des plus récentes aux plus anciennes.

← septembre 2013 novembre 2013 →

CVE-2013-4428OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly re… 3.5 FAIBLE

CVE-2013-4302(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki … 5.0 MOYENNE

CVE-2013-4301includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive info… 5.0 MOYENNE

CVE-2013-4122Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allo… 4.3 MOYENNE

CVE-2013-0337Les versions plus anciennes de nginx (1.3.13 et antérieures) peuvent installer des fichiers de journalisation avec des permissions permettant à tout utilisateur local du système de… 7.5 ÉLEVÉE

CVE-2013-6016Les équipements F5 BIG-IP et les appliances réseau associées (telles que LTM, APM et ASM) sont sensibles à une faille dans leur gestion des connexions TCP. Un attaquant distant peu… 7.8 ÉLEVÉE

CVE-2013-5914Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet. 6.8 MOYENNE

CVE-2013-4885The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted Ful… 6.8 MOYENNE

CVE-2013-1445The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which ma… 4.3 MOYENNE

CVE-2013-6284Les systèmes SAP ERP Central Component utilisant le composant Statutory Reporting for Insurance sont vulnérables à l'exécution de code à distance. Un attaquant non authentifié disp… 7.5 ÉLEVÉE

CVE-2011-4106TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL cont… 6.8 MOYENNE

CVE-2013-6283Les versions 2.0.8 et antérieures de VLC Media Player sont sensibles à une faille de corruption de mémoire lors du traitement de listes de lecture m3u spécialement conçues. Un atta… 7.5 ÉLEVÉE

CVE-2013-4965Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended … 5.0 MOYENNE

CVE-2013-4957The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type. 6.8 MOYENNE

CVE-2013-4465Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code … 4.6 MOYENNE

CVE-2013-4434Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote … 5.0 MOYENNE

CVE-2013-4421The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that… 5.0 MOYENNE

CVE-2013-1067Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file. 4.9 MOYENNE

CVE-2013-6128The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveToFile method calls, which allow… 5.8 MOYENNE

CVE-2013-6127The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which… 5.8 MOYENNE

CVE-2013-5424IBM Flex System Manager (FSM) 1.3.0 allows remote attackers to bypass intended access restrictions, and create new user accounts or execute tasks, by leveraging an expired password… 6.8 MOYENNE

CVE-2013-3989IBM Security AppScan Enterprise 8.x before 8.8 sends a cleartext AppScan Source database password in a response, which allows remote authenticated users to obtain sensitive informa… 3.5 FAIBLE

CVE-2013-6281Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web… 4.3 MOYENNE

CVE-2013-6280Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified … 4.3 MOYENNE

CVE-2013-5549Les routeurs Cisco IOS XR (versions 3.8.1 à 4.2.0) sont vulnérables à une attaque par déni de service pouvant entraîner une interruption complète des transmissions. Un attaquant di… 7.1 ÉLEVÉE

CVE-2013-5531Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted se… 5.0 MOYENNE

CVE-2013-5530Les versions 1.0 à 1.2 de Cisco Identity Services Engine (ISE) présentent une faille dans leur framework web qui permet à un attaquant distant d'exécuter des commandes système arbi… 9.0 ÉLEVÉE

CVE-2013-5522Cisco IOS on Catalyst 3750X switches has default Service Module credentials, which makes it easier for local users to gain privileges via a Service Module login, aka Bug ID CSCue92… 6.8 MOYENNE

CVE-2013-5521Cisco Identity Services Engine does not properly restrict the creation of guest accounts, which allows remote attackers to cause a denial of service (exhaustion of the account supp… 5.0 MOYENNE

CVE-2013-3280L'agent EMC RSA Authentication Agent 7.1.x pour IIS est affecté par un défaut de conception qui, par défaut, autorise l'accès si l'agent plante. Un attaquant distant et non authent… 7.5 ÉLEVÉE

CVE-2013-5537Les interfaces de gestion des appareils Cisco WSA, ESA et SMA sont vulnérables à une attaque par déni de service. Un attaquant distant non authentifié peut faire planter l'interfac… 7.8 ÉLEVÉE

CVE-2013-5536Cisco Secure Access Control System (ACS) does not properly implement an incoming-packet firewall rule, which allows remote attackers to cause a denial of service (process crash) vi… 5.0 MOYENNE

CVE-2013-5148Les versions d'Apple Keynote antérieures à la version 6.0 peuvent entrer en conflit avec le verrouillage de l'écran de macOS. Cela permet à une personne ayant un accès physique à u… 7.2 ÉLEVÉE

CVE-2013-5143The RADIUS service in Server App in Apple OS X Server before 3.0 selects a fallback X.509 certificate in unspecified circumstances, which might allow man-in-the-middle attackers to… 6.8 MOYENNE

CVE-2013-5130WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for context-dependent attackers to obtain browsing… 5.0 MOYENNE

CVE-2013-4443Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.…

CVE-2013-4299Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a… 6.0 MOYENNE

CVE-2013-1743Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitra… 4.3 MOYENNE

CVE-2013-1742Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4… 4.3 MOYENNE

CVE-2013-1734Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allo… 6.8 MOYENNE

CVE-2013-1733Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for reques… 6.8 MOYENNE

CVE-2013-6246The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (user's full name) by sending a login requ… 5.0 MOYENNE

CVE-2013-5192The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a request with a crafted (1) port or (2) port number. 4.9 MOYENNE

CVE-2013-5191The syslog implementation in Apple Mac OS X before 10.9 allows local users to obtain sensitive information by leveraging access to the Guest account and reading console-log message… 2.1 FAIBLE

CVE-2013-5190Smart Card Services in Apple Mac OS X before 10.9 does not properly implement certificate-revocation checks, which allows remote attackers to cause a denial of service (Smart Card … 4.3 MOYENNE

CVE-2013-5189Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows context-dependent attackers to bypass intende… 5.8 MOYENNE

CVE-2013-5188The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a transition out of hibernation, which all… 4.0 MOYENNE

CVE-2013-5187The Screen Lock implementation in Apple Mac OS X before 10.9 does not immediately accept Keychain Status menu Lock Screen commands, and instead incorrectly relies on a certain time… 1.9 FAIBLE

CVE-2013-5186Power Management in Apple Mac OS X before 10.9 does not properly handle the interaction between locking and power assertions, which allows physically proximate attackers to obtain … 2.1 FAIBLE

CVE-2013-5185The ldapsearch command-line program in OpenLDAP in Apple Mac OS X before 10.9 does not properly process the minssf configuration setting, which allows remote attackers to obtain se… 4.3 MOYENNE