Weekly Vulnerabilities Reports > January 14 to 20, 2013

Overview

3 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 0 high severity vulnerabilities. This weekly summary report vulnerabilities in 11 products from 8 vendors including Canonical, Adobe, Oracle, Fedoraproject, and Opensuse. Vulnerabilities are notably categorized as "Incorrect Default Permissions", and "XXE".

  • 2 reported vulnerabilities are remotely exploitables.
  • 2 reported vulnerabilities have public exploit available.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 1 reported vulnerabilities are exploitable by an anonymous user.
  • Canonical has the most reported vulnerabilities, with 2 reported vulnerabilities.
  • Adobe has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2013-01-17 CVE-2013-0632 Adobe Incorrect Default Permissions vulnerability in Adobe Coldfusion

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
9.8

0 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

2 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2013-01-18 CVE-2012-5656 Inkscape
Fedoraproject
Canonical
Opensuse 		XXE vulnerability in multiple products

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
5.5
2013-01-17 CVE-2013-0375 Oracle
Mariadb
Canonical
Redhat 		Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.
5.4

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS