# CVEs published 2013-03-20 29 CVEs were published on March 20, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-1875](https://cve.now/CVE-2013-1875.md): command\_wrap.rb in the command\_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL… (no CVSS, command\_wrap) - [CVE-2013-2615](https://cve.now/CVE-2013-2615.md): lib/entry\_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell… (no CVSS, fastreader) - [CVE-2013-2616](https://cve.now/CVE-2013-2616.md): lib/mini\_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in… (no CVSS, mini\_magick) - [CVE-2013-2617](https://cve.now/CVE-2013-2617.md): lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. (no CVSS, curl) - [CVE-2013-0711](https://cve.now/CVE-2013-0711.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via… (no CVSS) - [CVE-2013-0712](https://cve.now/CVE-2013-0712.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon… (no CVSS) - [CVE-2013-0713](https://cve.now/CVE-2013-0713.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon… (no CVSS) - [CVE-2013-0714](https://cve.now/CVE-2013-0714.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS) - [CVE-2013-0715](https://cve.now/CVE-2013-0715.md): The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session… (no CVSS) - [CVE-2013-0716](https://cve.now/CVE-2013-0716.md): The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI. (no CVSS) - [CVE-2013-1750](https://cve.now/CVE-2013-1750.md): Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to… (no CVSS) - [CVE-2013-1640](https://cve.now/CVE-2013-1640.md): The (1) template and (2) inline\_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before… (no CVSS) - [CVE-2013-1652](https://cve.now/CVE-2013-1652.md): Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote… (no CVSS) - [CVE-2013-1653](https://cve.now/CVE-2013-1653.md): Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when… (no CVSS) - [CVE-2013-1654](https://cve.now/CVE-2013-1654.md): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol… (no CVSS) - [CVE-2013-1655](https://cve.now/CVE-2013-1655.md): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via… (no CVSS, puppet) - [CVE-2013-2274](https://cve.now/CVE-2013-2274.md): Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the… (no CVSS) - [CVE-2013-2275](https://cve.now/CVE-2013-2275.md): The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and… (no CVSS) - [CVE-2013-0232](https://cve.now/CVE-2013-0232.md): includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via… (no CVSS) - [CVE-2013-0332](https://cve.now/CVE-2013-0332.md): Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2013-1766](https://cve.now/CVE-2013-1766.md): libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified… (no CVSS) - [CVE-2013-1842](https://cve.now/CVE-2013-1842.md): SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x… (no CVSS, typo3/cms-core) - [CVE-2013-1843](https://cve.now/CVE-2013-1843.md): Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and… (no CVSS, typo3/cms-core) - [CVE-2012-5938](https://cve.now/CVE-2012-5938.md): The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and… (no CVSS) - [CVE-2013-0977](https://cve.now/CVE-2013-0977.md): dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files… (no CVSS) - [CVE-2013-0978](https://cve.now/CVE-2013-0978.md): The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked… (no CVSS) - [CVE-2013-0979](https://cve.now/CVE-2013-0979.md): lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup… (no CVSS) - [CVE-2013-0980](https://cve.now/CVE-2013-0980.md): The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate… (no CVSS) - [CVE-2013-0981](https://cve.now/CVE-2013-0981.md): The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2013-03-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.