2013

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x

Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke

Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hija

Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anyw

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote at

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in

Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4

ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remo

The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access

The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description met

The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the pr

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed o

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to

The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-

wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive informatio

Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive

Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests.

Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary

Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web

Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of

Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, whic

Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain

Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) vi

Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or

Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or

Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remo

The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers

Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger d

ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow remo

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote

modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability ne

IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and

The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexp

Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL sof