RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
(COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM)

Cyber Security: This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID:     CVE-2013-2751
Title:  NETGEAR ReadyNAS Flaw Allows Root Access from Unauthenticated
HTTP Request
Vendor: NETGEAR
Description: NETGEAR ReadyNAS with firmware 4.2.x before 4.2.24 and
4.1.x before 4.1.12 is vulernable to command injection from an
unauthenticated HTTP GET request.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:     N/A
Title:  Jelsoft vBulletin Unspecified Security Bypass Vulnerability
Vendor: Jelsoft Enterprises Ltd
Description: A remote exploitation of an unspecified vulnerability in
Jelsoft Enterprises Ltd.’s vBulletin could allow attackers to bypass
security restrictions. vBulletin versions 4.x.x and 5.x.x are reported
to be vulnerable.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:     CVE-2013-3918
Title:  Microsoft ActiveX Controls “InformationCardSigninHelper Class”
Out-of-Bounds Memory Access Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in the
InformationCardSigninHelper Class ActiveX control.  Specifically the
issue occurs in the way “InformationCardSigninHelper Class” ActiveX
control (icardie.dll) is loaded into Internet Explorer and causes system
state corruption.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID:     CVE-2013-3906
Title:  Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: Remote exploitation of a memory corruption vulnerability
in multiple Microsoft products could allow attackers to execute
arbitrary code on the targeted host. The issue occurs with how the TIFF
codec in Microsoft’s graphics component handles crafted TIFF files.
Processing crafted TIFF files can corrupt system memory and create an
exploitable condition.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID:     Not Available
Title:  D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:     CVE-2013-2251
Title:  Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)