56.658 CVE tracked
776 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.658 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2013-4317 | MED 4.3 | apache cloudstack In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own. | 1.2% | — |
| CVE-2013-4171 | MED 4.3 | apache roller Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates. | 3.0% | — |
| CVE-2013-3970 | MED 4.3 | juniper junos_pulse_access_control_service Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trus | 0.5% | — |
| CVE-2013-3909 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences, aka "Internet Explorer Information Disclosure Vulnerability." | 16.4% | — |
| CVE-2013-3908 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information from any visited document via a crafted web page that is not properly handled during a print-preview action, aka "I | 36.3% | — |
| CVE-2013-3649 | MED 4.3 | kent-web clip-mail Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field. | 1.1% | — |
| CVE-2013-3648 | MED 4.3 | kent-web post-mail Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field. | 1.1% | — |
| CVE-2013-3498 | MED 4.3 | juniper smartpass Cross-site scripting (XSS) vulnerability in Juniper SmartPass WLAN Security Management before 7.7 MR3 and 8.0 before MR2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 1.8% | — |
| CVE-2013-3471 | MED 4.3 | cisco identity_services_engine_software The captive portal application in Cisco Identity Services Engine (ISE) allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515. | 1.4% | — |
| CVE-2013-3463 | MED 4.3 | cisco adaptive_security_appliance The protocol-inspection feature on Cisco Adaptive Security Appliances (ASA) devices does not properly implement the idle timeout, which allows remote attackers to cause a denial of service (connection-table exhaustion) via crafted requests that use an inspecte | 2.4% | — |
| CVE-2013-3440 | MED 4.3 | cisco unified_operations_manager Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML, and obtain improperly secured cookies, via unspecified vectors, aka Bug I | 1.2% | — |
| CVE-2013-3439 | MED 4.3 | cisco unified_operations_manager Cross-site scripting (XSS) vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified HTTP header field, aka Bug ID CSCud80182. | 1.8% | — |
| CVE-2013-3423 | MED 4.3 | cisco secure_access_control_system Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCud75174. | 0.9% | — |
| CVE-2013-3422 | MED 4.3 | cisco secure_access_control_system Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75165. | 0.9% | — |
| CVE-2013-3421 | MED 4.3 | cisco secure_access_control_system Cross-site scripting (XSS) vulnerability in the Help index page in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170. | 0.9% | — |
| CVE-2013-3419 | MED 4.3 | cisco unified_meetingplace_web_conferencing Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh74981. | 0.9% | — |
| CVE-2013-3416 | MED 4.3 | cisco unified_operations_manager Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Operations Manager and Unified Service Monitor allows remote attackers to inject arbitrary web script or HTML via an unspecif | 1.1% | — |
| CVE-2013-3414 | MED 4.3 | cisco adaptive_security_appliance Cross-site scripting (XSS) vulnerability in the WebVPN portal login page on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCug83080. | 2.1% | — |
| CVE-2013-3413 | MED 4.3 | cisco identity_services_engine_software Cross-site scripting (XSS) vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuh87036. | 0.9% | — |
| CVE-2013-3409 | MED 4.3 | cisco prime_central_for_hosted_collaboration_solution The portal in Cisco Prime Central for Hosted Collaboration Solution (HCS) places cleartext credentials in temporary files, which allows local users to obtain sensitive information by leveraging weak file permissions to read these files, aka Bug IDs CSCuh33735 | 0.3% | — |
| CVE-2013-3405 | MED 4.3 | cisco telepresence_tc_software The web portal in TC software on Cisco TelePresence endpoints does not require an exact password match during a login attempt by a user who has not configured a password, which allows remote attackers to bypass authentication by sending an arbitrary password, | 1.2% | — |
| CVE-2013-3401 | MED 4.3 | cisco telepresence_tc_software The SIP implementation in Cisco TelePresence TC Software allows remote attackers to trigger unintended use of NOTIFY messages via unspecified vectors, aka Bug ID CSCud96080. | 1.0% | — |
| CVE-2013-3396 | MED 4.3 | cisco content_security_management_appliance Cross-site scripting (XSS) vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance (SMA) devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749 | 0.9% | — |
| CVE-2013-3394 | MED 4.3 | cisco prime_network_registrar Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted field, aka Bug ID CSCuh41429. | 0.9% | — |
| CVE-2013-3392 | MED 4.3 | cisco webex_social Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco WebEx Social allow remote attackers to hijack the authentication of arbitrary users via unspecified vectors, aka Bug IDs CSCuh10405 and CSCuh10355. | 0.5% | — |