First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2013-7231

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009Vendor Advisory
http://support.esri.com/en/knowledgebase/techarticles/detail/41468Vendor Advisory
http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009Vendor Advisory
http://support.esri.com/en/knowledgebase/techarticles/detail/41468Vendor Advisory

Timeline

Published: Dec 30, 2013
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-72327.5SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2013-72336.8Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlie CVE-2013-72344.3Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Option CVE-2013-72357.5Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space cha CVE-2013-72367.5Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph charac CVE-2013-72394.8memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending a CVE-2013-72405.0Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read ar CVE-2013-72414.3Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows rem CVE-2013-72426.5SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrat CVE-2013-72434.3Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script o CVE-2013-72457.5The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database du CVE-2013-72469.3Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to