CVE-2013-10031

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1254

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Jun 16, 2026
NVD status
Analyzed

Related CVEs from 2013

CVE-2013-100328.8An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authCVE-2013-100339.3An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers toCVE-2013-100349.3An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthentiCVE-2013-100358.7A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated usCVE-2013-100368.4A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameCVE-2013-100379.3An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cCVE-2013-100389.3An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fCVE-2013-100398.7A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter CVE-2013-10049.3WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (meCVE-2013-100409.8ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-liCVE-2013-100429.8A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of the FTP PASS command. When an aCVE-2013-100439.5A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script all
CVE-2013-10031: High severity, CVSS 7.5 | Vulnix