CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 0CVE-2013-4409
https://notcve.org/view.php?id=CVE-2013-4409
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. Existe una vulnerabilidad de la función eval() en Python Software Foundation Djblets versión 0.7.21 y Beanbag Review Board versiones anteriores a la versión 1.7.15, cuando se analizan peticiones JSON. • http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119819.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119830.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119831.html http://www.securityfocus.com/bid/63029 https://access.redhat.com/security/cve/cve-2013-4409 https:/& • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 29EXPL: 0CVE-2013-4795
https://notcve.org/view.php?id=CVE-2013-4795
Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script or HTML via a user full name. Vulnerabilidad de XSS en la lista Submitters en Review Board 1.6.x anterior a 1.6.18 y 1.7.x anterior a 1.7.12 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un nombre completo de usuario. • http://osvdb.org/show/osvdb/96170 http://seclists.org/bugtraq/2013/Aug/69 http://secunia.com/advisories/54272 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.18 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.12 http://www.securityfocus.com/bid/61750 http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard https://exchange.xforce.ibmcloud.com/vulnerabilities/86410 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 0CVE-2013-4519
https://notcve.org/view.php?id=CVE-2013-4519
Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file. Múltiples vulnerabilidades de XSS en Review Board 1.6.x anterior a la versión 1.6.21 y 1.7.x anterior a 1.7.17 permite a atacantes remotos inyectar script web o HTML arbitrario a través del (1) campo Branch o (2) título de un archivo cargado. • http://osvdb.org/99512 http://osvdb.org/99513 http://secunia.com/advisories/55623 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.21 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.17 http://www.securityfocus.com/bid/63601 https://exchange.xforce.ibmcloud.com/vulnerabilities/88620 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 32EXPL: 1CVE-2013-2209
https://notcve.org/view.php?id=CVE-2013-2209
Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name. Vulnerabilidad XSS en el widget de autocompletado en enhtdocs/media/rb/js/reviews.js en Review Board 1.6.x anteior a 1.6.17 y 1.7.x anterior a 1.7.10, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un nombre completo. • http://www.openwall.com/lists/oss-security/2013/06/24/2 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17 http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10 http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard https://bugzilla.redhat.com/show_bug.cgi?id=977423 https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a808 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •