CVE-2013-4094

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The Key Management feature in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the (1) private_key or (2) public_key parameter in a T/keyManagement request to plain/settings.html, as demonstrated by uploading a Linux ELF file and a shell script.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-40956.5plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authentic CVE-2013-40969.0ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary commands via shell CVE-2013-40975.0ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request, CVE-2013-40985.0ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message paramete CVE-2013-409910.0Multiple unspecified vulnerabilities in OpenAL32.dll in JOAL 2.0-rc11, as used in JOGAMP, allow context-dependent attackers to execute arbit CVE-2013-41007.5Cryptocat before 2.0.22 has Remote Denial of Service via username CVE-2013-41015.3Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness CVE-2013-41029.1Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness CVE-2013-41039.8Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input CVE-2013-41047.5Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol CVE-2013-41057.5Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure CVE-2013-41066.1A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22.