# CVEs published 2013-07-10

71 CVEs were published on July 10, 2013: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-2352](https://cve.now/CVE-2013-2352.md): LeftHand OS (aka SAN iQ) 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support… (no CVSS)
- [CVE-2013-2784](https://cve.now/CVE-2013-2784.md): Triangle Research International (aka Tri) Nano-10 PLC devices with firmware before r81 use an incorrect algorithm for bounds checking of… (no CVSS)
- [CVE-2013-2786](https://cve.now/CVE-2013-2786.md): Alstom Grid MiCOM S1 Agile before 1.0.3 and Alstom Grid MiCOM S1 Studio use weak permissions for the MiCOM S1 %PROGRAMFILES% directory… (no CVSS)
- [CVE-2013-1132](https://cve.now/CVE-2013-1132.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject… (no CVSS)
- [CVE-2013-3408](https://cve.now/CVE-2013-3408.md): The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users… (no CVSS)
- [CVE-2013-3416](https://cve.now/CVE-2013-3416.md): Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified… (no CVSS)
- [CVE-2013-3579](https://cve.now/CVE-2013-3579.md): The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash)… (no CVSS)
- [CVE-2013-1896](https://cve.now/CVE-2013-1896.md): mod\_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote… (no CVSS)
- [CVE-2013-3400](https://cve.now/CVE-2013-3400.md): The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users to execute arbitrary commands via crafted… (no CVSS)
- [CVE-2013-3405](https://cve.now/CVE-2013-3405.md): The web portal in TC software on Cisco TelePresence endpoints does not require an exact password match during a login attempt by a user… (no CVSS)
- [CVE-2012-5855](https://cve.now/CVE-2012-5855.md): The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of… (no CVSS)
- [CVE-2013-1868](https://cve.now/CVE-2013-1868.md): Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and… (no CVSS)
- [CVE-2013-1954](https://cve.now/CVE-2013-1954.md): The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2013-1965](https://cve.now/CVE-2013-1965.md): Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL… (no CVSS, org.apache.struts:struts2-core)
- [CVE-2013-1966](https://cve.now/CVE-2013-1966.md): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…)
- [CVE-2013-2115](https://cve.now/CVE-2013-2115.md): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…)
- [CVE-2013-3245](https://cve.now/CVE-2013-3245.md): plugins/demux/libmkv\_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial… (CVSS 6.3)
- [CVE-2013-2853](https://cve.now/CVE-2013-2853.md): The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \\r\\n\\r\\n (carriage return… (no CVSS)
- [CVE-2013-2867](https://cve.now/CVE-2013-2867.md): Google Chrome before 28.0.1500.71 does not properly prevent pop-under windows, which allows remote attackers to have an unspecified impact… (no CVSS)
- [CVE-2013-2868](https://cve.now/CVE-2013-2868.md): common/extensions/sync\_helper.cc in Google Chrome before 28.0.1500.71 proceeds with sync operations for NPAPI extensions without checking… (no CVSS)
- [CVE-2013-2869](https://cve.now/CVE-2013-2869.md): Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image. (no CVSS)
- [CVE-2013-2870](https://cve.now/CVE-2013-2870.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response… (no CVSS)
- [CVE-2013-2871](https://cve.now/CVE-2013-2871.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have… (no CVSS)
- [CVE-2013-2872](https://cve.now/CVE-2013-2872.md): Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it… (no CVSS)
- [CVE-2013-2873](https://cve.now/CVE-2013-2873.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have… (no CVSS)
- [CVE-2013-2874](https://cve.now/CVE-2013-2874.md): Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on… (no CVSS)
- [CVE-2013-2875](https://cve.now/CVE-2013-2875.md): core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote… (no CVSS)
- [CVE-2013-2876](https://cve.now/CVE-2013-2876.md): browser/extensions/api/tabs/tabs\_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of… (no CVSS)
- [CVE-2013-2877](https://cve.now/CVE-2013-2877.md): parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a… (no CVSS)
- [CVE-2013-2878](https://cve.now/CVE-2013-2878.md): Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the… (no CVSS)
- [CVE-2013-2879](https://cve.now/CVE-2013-2879.md): Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted… (no CVSS)
- [CVE-2013-2880](https://cve.now/CVE-2013-2880.md): Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have… (no CVSS)
- [CVE-2013-3344](https://cve.now/CVE-2013-3344.md): Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before… (no CVSS)
- [CVE-2013-3345](https://cve.now/CVE-2013-3345.md): Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before… (no CVSS)
- [CVE-2013-3347](https://cve.now/CVE-2013-3347.md): Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on… (no CVSS)
- [CVE-2013-3348](https://cve.now/CVE-2013-3348.md): Adobe Shockwave Player before 12.0.3.133 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2013-3349](https://cve.now/CVE-2013-3349.md): Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to… (no CVSS)
- [CVE-2013-3350](https://cve.now/CVE-2013-3350.md): Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets. (no CVSS)
- [CVE-2013-1300](https://cve.now/CVE-2013-1300.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… (no CVSS)
- [CVE-2013-1340](https://cve.now/CVE-2013-1340.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… (CVSS 8.4)
- [CVE-2013-1345](https://cve.now/CVE-2013-1345.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… (no CVSS)
- [CVE-2013-3115](https://cve.now/CVE-2013-3115.md): Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3127](https://cve.now/CVE-2013-3127.md): The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media… (no CVSS)
- [CVE-2013-3129](https://cve.now/CVE-2013-3129.md): Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and… (CVSS 7.8)
- [CVE-2013-3131](https://cve.now/CVE-2013-3131.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data… (no CVSS)
- [CVE-2013-3132](https://cve.now/CVE-2013-3132.md): Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use… (no CVSS)
- [CVE-2013-3133](https://cve.now/CVE-2013-3133.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which… (no CVSS)
- [CVE-2013-3134](https://cve.now/CVE-2013-3134.md): The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly… (no CVSS)
- [CVE-2013-3143](https://cve.now/CVE-2013-3143.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… (no CVSS)
- [CVE-2013-3144](https://cve.now/CVE-2013-3144.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3145](https://cve.now/CVE-2013-3145.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2013-3146](https://cve.now/CVE-2013-3146.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2013-3147](https://cve.now/CVE-2013-3147.md): Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… (no CVSS)
- [CVE-2013-3148](https://cve.now/CVE-2013-3148.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3149](https://cve.now/CVE-2013-3149.md): Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… (no CVSS)
- [CVE-2013-3150](https://cve.now/CVE-2013-3150.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2013-3151](https://cve.now/CVE-2013-3151.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3152](https://cve.now/CVE-2013-3152.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2013-3153](https://cve.now/CVE-2013-3153.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3154](https://cve.now/CVE-2013-3154.md): The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname… (no CVSS)
- [CVE-2013-3161](https://cve.now/CVE-2013-3161.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… (no CVSS)
- [CVE-2013-3162](https://cve.now/CVE-2013-3162.md): Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory… (no CVSS)
- [CVE-2013-3163](https://cve.now/CVE-2013-3163.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (CVSS 8.8, KEV)
- [CVE-2013-3164](https://cve.now/CVE-2013-3164.md): Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2013-3166](https://cve.now/CVE-2013-3166.md): Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2013-3167](https://cve.now/CVE-2013-3167.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… (no CVSS)
- [CVE-2013-3171](https://cve.now/CVE-2013-3171.md): The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the… (no CVSS)
- [CVE-2013-3172](https://cve.now/CVE-2013-3172.md): Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2… (no CVSS)
- [CVE-2013-3173](https://cve.now/CVE-2013-3173.md): Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2… (no CVSS)
- [CVE-2013-3174](https://cve.now/CVE-2013-3174.md): DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… (no CVSS)
- [CVE-2013-3178](https://cve.now/CVE-2013-3178.md): Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2013-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.