Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (91288 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2013-4791 1 Prestashop 1 Prestashop 2024-11-21 5.4 Medium
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
CVE-2013-4770 1 Eucalyptus 1 Eucalyptus Management Console 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-4752 2 Fedoraproject, Sensiolabs 2 Fedora, Symfony 2024-11-21 6.1 Medium
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
CVE-2013-4718 1 Otrs 2 Otrs, Otrs Itsm 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.
CVE-2013-4695 1 Winamp 1 Winamp 2024-11-21 7.8 High
Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
CVE-2013-4693 1 Xorbin 1 Digital Flash Clock 2024-11-21 6.1 Medium
WordPress Xorbin Digital Flash Clock 1.0 has XSS
CVE-2013-4692 1 Xorbin 1 Analog Flash Clock 2024-11-21 6.1 Medium
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS
CVE-2013-4691 1 Sencha 1 Connect 2024-11-21 6.1 Medium
Sencha Labs Connect has XSS with connect.methodOverride()
CVE-2013-4664 1 Spbas 1 Business Automation Software 2024-11-21 6.1 Medium
SPBAS Business Automation Software 2012 has XSS.
CVE-2013-4584 2 Debian, Horms 2 Debian Linux, Perdition 2024-11-21 5.9 Medium
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVE-2013-4486 2 Linux, Redhat 2 Linux Kernel, Zanata 2024-11-21 9.8 Critical
Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging
CVE-2013-4395 1 Simplemachines 1 Simple Machines Forum 2024-11-21 6.1 Medium
Simple Machines Forum (SMF) through 2.0.5 has XSS
CVE-2013-4367 2 Linux, Ovirt 2 Linux Kernel, Ovirt-engine 2024-11-21 7.8 High
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.
CVE-2013-4335 1 Openpne 1 Opopensocialplugin 2024-11-21 9.8 Critical
opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities
CVE-2013-4318 1 Feature Project 1 Feature 2024-11-21 5.4 Medium
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.
CVE-2013-4303 1 Mediawiki 1 Mediawiki 2024-11-21 6.1 Medium
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
CVE-2013-4275 1 Zen Project 1 Zen 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, and 7.x-5.x before 7.x-5.4 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the breadcrumb separator field.
CVE-2013-4267 1 Pydio 1 Pydio 2024-11-21 9.8 Critical
Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php).
CVE-2013-4241 1 Hitmyserver 1 Hms Testimonials 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
CVE-2013-4225 2 Redhat, Restful Web Services Project 2 Satellite, Restful Web Services 2024-11-21 8.8 High
The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.