# CVEs published 2013-10-28

28 CVEs were published on October 28, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2010-1159](https://cve.now/CVE-2010-1159.md): Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute… (no CVSS)
- [CVE-2012-0825](https://cve.now/CVE-2012-0825.md): Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote… (no CVSS)
- [CVE-2012-0826](https://cve.now/CVE-2012-0826.md): Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote… (no CVSS)
- [CVE-2012-0827](https://cve.now/CVE-2012-0827.md): The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read… (no CVSS)
- [CVE-2012-6303](https://cve.now/CVE-2012-6303.md): Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer… (no CVSS)
- [CVE-2013-2208](https://cve.now/CVE-2013-2208.md): tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file. (no CVSS)
- [CVE-2013-3243](https://cve.now/CVE-2013-3243.md): Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors. (no CVSS)
- [CVE-2013-3704](https://cve.now/CVE-2013-3704.md): The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a… (no CVSS)
- [CVE-2013-4391](https://cve.now/CVE-2013-4391.md): Integer overflow in the valid\_user\_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2013-4392](https://cve.now/CVE-2013-4392.md): systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files… (CVSS 5.0)
- [CVE-2013-4393](https://cve.now/CVE-2013-4393.md): journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service… (no CVSS)
- [CVE-2013-4394](https://cve.now/CVE-2013-4394.md): The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard… (no CVSS)
- [CVE-2013-4402](https://cve.now/CVE-2013-4402.md): The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2013-5744](https://cve.now/CVE-2013-5744.md): Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2013-6012](https://cve.now/CVE-2013-6012.md): Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle… (no CVSS)
- [CVE-2013-6014](https://cve.now/CVE-2013-6014.md): Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45… (no CVSS)
- [CVE-2013-6288](https://cve.now/CVE-2013-6288.md): Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack… (no CVSS, apache-solr-for-typo3/solr)
- [CVE-2013-6289](https://cve.now/CVE-2013-6289.md): Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to… (no CVSS, apache-solr-for-typo3/solr)
- [CVE-2012-4529](https://cve.now/CVE-2012-4529.md): The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to… (no CVSS)
- [CVE-2012-4572](https://cve.now/CVE-2012-4572.md): Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a… (no CVSS)
- [CVE-2013-1056](https://cve.now/CVE-2013-1056.md): X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain… (no CVSS)
- [CVE-2013-2102](https://cve.now/CVE-2013-2102.md): The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a… (no CVSS)
- [CVE-2013-2186](https://cve.now/CVE-2013-2186.md): The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red… (no CVSS, commons-fileupload:commons-fileupload)
- [CVE-2013-5430](https://cve.now/CVE-2013-5430.md): The Jazz Team Server component in IBM Security AppScan Enterprise 8.x before 8.8 has a default username and password, which makes it… (no CVSS)
- [CVE-2013-6018](https://cve.now/CVE-2013-6018.md): Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the… (no CVSS)
- [CVE-2013-6019](https://cve.now/CVE-2013-6019.md): Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2013-6020](https://cve.now/CVE-2013-6020.md): passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests… (no CVSS)
- [CVE-2013-6285](https://cve.now/CVE-2013-6285.md): The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2013-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.