CVE-2013-3359
published 2013-09-12CVE-2013-3359: Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a…
PriorityP342critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
3.84%
88.9th percentile
Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3360.
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | shockwave_player | <= 12.0.3.133 | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
| adobe | shockwave_player | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q2c4-3vph-r3ph: Adobe Shockwave Player before 12
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2013-3360 [CRITICAL] CWE-119 GHSA-q2c4-3vph-r3ph: Adobe Shockwave Player before 12
Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3359.
GHSA
GHSA-q636-6vgx-r5mq: Adobe Shockwave Player before 12
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2013-3359 [CRITICAL] CWE-119 GHSA-q636-6vgx-r5mq: Adobe Shockwave Player before 12
Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3360.
Red Hat
conga: insecure handling of luci web interface sessions
vendor_redhat·2013-01-07·CVSS 3.7
CVE-2012-3359 [LOW] conga: insecure handling of luci web interface sessions
conga: insecure handling of luci web interface sessions
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
Package: conga (Red Hat Enterprise Linux 5) - Affected
Red Hat
conga: insecure handling of luci web interface sessions
vendor_redhat·2013-01-07·CVSS 3.7
CVE-2013-7347 [LOW] conga: insecure handling of luci web interface sessions
conga: insecure handling of luci web interface sessions
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
Package: conga (Red Hat Enterprise Linux 5) - Affected
No detection rules found.
No public exploits indexed.
2013-09-12
Published