PUBLIÉES EN
novembre 2013
399 CVE, des plus récentes aux plus anciennes.
CVE-2013-6918The web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes the console without authentication on the WAN IP address regardless of the "Web Manag…
5.8 MOYENNE
CVE-2013-5636Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physica…
3.3 FAIBLE
CVE-2013-5635Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proxim…
3.3 FAIBLE
CVE-2013-6392The genlock_dev_ioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and o…
4.9 MOYENNE
CVE-2013-6791Microsoft Enhanced Mitigation Experience Toolkit (EMET) before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat …
4.3 MOYENNE
CVE-2013-6307Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5 FAIBLE
CVE-2013-5463The WinCollect agent in IBM Security QRadar SIEM before 7.1.1.569824 allows remote attackers to bypass intended access restrictions by injecting a (1) DLL or (2) configuration file…
4.3 MOYENNE
CVE-2013-5448Cross-site scripting (XSS) vulnerability in the Right Click Plugin context menus in IBM Security QRadar SIEM 7.1 and 7.2 before 7.2 MR1 Patch 1 allows remote authenticated users to…
3.5 FAIBLE
CVE-2013-6885The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users t…
4.7 MOYENNE
CVE-2013-6706The Cisco Express Forwarding processing module in Cisco IOS XE allows remote attackers to cause a denial of service (device reload) via crafted MPLS packets that are not properly h…
5.4 MOYENNE
CVE-2013-6700The SNMP module in Cisco IOS XR allows remote attackers to cause a denial of service (process reload) via a request for an unspecified MIB, aka Bug ID CSCuh43144.
5.0 MOYENNE
CVE-2013-4844HP Service Manager (versions 7.11, 9.21-9.32) et ServiceCenter (6.2.8) sont vulnérables à l'exécution de code à distance. Un attaquant disposant d'un accès réseau peut exécuter des…
7.5 ÉLEVÉE
CVE-2013-6712The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to caus…
5.0 MOYENNE
CVE-2013-6322Cross-site scripting (XSS) vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated…
3.5 FAIBLE
CVE-2013-5912Le serveur Thomson Reuters Velocity Analytics Vhayu Analytic Server (version 6.94 build 2995) est vulnérable à l'exécution de code à distance via le composant VhttpdMgr. Un attaqua…
10.0 ÉLEVÉE
CVE-2013-5065Windows XP SP2/SP3 et Windows Server 2003 SP2 sont affectés par une faille dans le pilote noyau NDProxy. Un utilisateur local peut obtenir des privilèges complets au niveau du syst…
KEV
7.8 ÉLEVÉE
CVE-2013-5957Les versions de CiviCRM antérieures à 4.2.12, 4.3.7 et 4.4.beta4 sont affectées par des failles d'injection SQL sur certaines pages AJAX basées sur la localisation. Un attaquant di…
7.5 ÉLEVÉE
CVE-2013-4624Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to…
4.3 MOYENNE
CVE-2013-4617Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote attackers to obtain potentially sensiti…
5.0 MOYENNE
CVE-2013-3920Cross-site scripting (XSS) vulnerability in Jahia xCM before 6.6.2 allows remote authenticated users to inject arbitrary web script or HTML via the "about me" field.
3.5 FAIBLE
CVE-2013-6383The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass in…
6.9 MOYENNE
CVE-2013-6382Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecif…
4.0 MOYENNE
CVE-2013-6381Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibl…
6.9 MOYENNE
CVE-2013-6380The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cau…
4.7 MOYENNE
CVE-2013-6378The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging ro…
4.4 MOYENNE
CVE-2013-4036Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 FP13, and IBM InfoSphere Master Data Mana…
3.5 FAIBLE
CVE-2013-3394Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a …
4.3 MOYENNE
CVE-2013-6875Les installations de Nagios XI utilisant le Core Config Manager (antérieures à la version 2012R2.4) sont vulnérables à l'injection SQL via le paramètre `tfPassword`. Un attaquant d…
7.5 ÉLEVÉE
CVE-2013-6874Les versions de Vortex Light Alloy antérieures à la 4.7.4 sont vulnérables à un dépassement de tampon déclenché par une URL anormalement longue et spécifiquement conçue dans un fic…
9.3 ÉLEVÉE
CVE-2013-6873Le système de gestion de tests en ligne Testa Online Test Management System (OTMS) version 2.0.0.2 est affecté par une faille permettant à un attaquant d'exécuter des commandes de …
7.5 ÉLEVÉE
CVE-2013-3923Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request.
5.0 MOYENNE
CVE-2013-4525Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 …
3.5 FAIBLE
CVE-2013-4524Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authentic…
6.8 MOYENNE
CVE-2013-4523Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated us…
3.5 FAIBLE
CVE-2013-4522lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote a…
5.0 MOYENNE
CVE-2013-6870Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3 MOYENNE
CVE-2013-6374Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via …
3.5 FAIBLE
CVE-2013-6373The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecifie…
5.5 MOYENNE
CVE-2013-4573Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote att…
4.3 MOYENNE
CVE-2013-3922FTP Drive + HTTP Server (version 1.0.4 et antérieures) est affecté par une faille qui permet à des attaquants distants de lire n'importe quel fichier sur le système hôte. En envoya…
7.8 ÉLEVÉE
CVE-2012-6608Cross-site scripting (XSS) vulnerability in xmlservices/E_book.php in Elastix 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the Page parameter.
4.3 MOYENNE
CVE-2013-6379Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4513. Reason: This candidate is a duplicate of CVE-2013-4513. Notes: All CVE users should reference CVE-2…
CVE-2013-5458Les systèmes utilisant IBM Java SDK 7.0.0 (antérieurs au SR6) sont vulnérables à l'exécution de code à distance. Un attaquant non authentifié disposant d'un accès réseau peut poten…
9.3 ÉLEVÉE
CVE-2013-5457Les anciennes versions du SDK Java d'IBM (6.0.0, 6.0.1 et 7.0.0) sont affectées par une faille qui permet à un attaquant distant d'exécuter du code arbitraire sur le système hôte. …
9.3 ÉLEVÉE
CVE-2013-5456L'IBM Java SDK 7.0.0 (antérieur au SR6) est affecté par une faille dans sa gestion des données sérialisées. Un attaquant distant non authentifié peut contourner les restrictions de…
9.3 ÉLEVÉE
CVE-2013-5375Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via …
6.8 MOYENNE
CVE-2013-4041Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via …
6.8 MOYENNE
CVE-2013-6869SAP NetWeaver 7.30 est affecté par une faille qui permet à un attaquant distant d'exécuter des commandes SQL arbitraires sur la base de données. Comme cela ne nécessite ni authenti…
7.5 ÉLEVÉE
CVE-2013-4509The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password cha…
1.9 FAIBLE
CVE-2013-4164Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers …
6.8 MOYENNE