CVE-2013-3565

Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.

• CWE-79

• http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git%3Ba=commitdiff%3Bh=bf02b8dd211d5a52aa301a9a2ff4e73ed8195881
• http://lists.opensuse.org/opensuse-updates/2014-03/msg00001.htmlThird Party Advisory
• http://www.videolan.org/developers/vlc-branch/NEWSRelease Notes
• https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-007.txtExploit, Third Party Advisory
• http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git%3Ba=commitdiff%3Bh=bf02b8dd211d5a52aa301a9a2ff4e73ed8195881
• http://lists.opensuse.org/opensuse-updates/2014-03/msg00001.htmlThird Party Advisory
• http://www.videolan.org/developers/vlc-branch/NEWSRelease Notes
• https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-007.txtExploit, Third Party Advisory

Published

Jan 31, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-3559epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector …
• CVE-2013-3560The dissect_dsmcc_un_download function in epan/dissectors/pa…
• CVE-2013-3561Multiple integer overflows in Wireshark 1.8.x before 1.8.7 a…
• CVE-2013-3562Multiple integer signedness errors in the tvb_unmasked funct…
• CVE-2013-3563Stack-based buffer overflow in db_netserver in Lianja SQL Se…
• CVE-2013-3564The web interface in VideoLAN VLC media player before 2.0.7 …5.3
• CVE-2013-3567Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppe…
• CVE-2013-3568Cross-site request forgery (CSRF) vulnerability in Cisco Lin…8.8
• CVE-2013-3571socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, w…
• CVE-2013-3572Cross-site scripting (XSS) vulnerability in the administer i…6.1
• CVE-2013-3573HP Insight Diagnostics 9.4.0.4710 allows remote attackers to…
• CVE-2013-3574Absolute path traversal vulnerability in hpdiags/frontend2/c…