# CVEs published 2013-12-13

27 CVEs were published on December 13, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7093](https://cve.now/CVE-2013-7093.md): SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via… (no CVSS)
- [CVE-2013-7094](https://cve.now/CVE-2013-7094.md): SQL injection vulnerability in the RSDDCVER\_COUNT\_TAB\_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2013-7095](https://cve.now/CVE-2013-7095.md): The XML parser (crm\_flex\_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to… (no CVSS)
- [CVE-2013-7096](https://cve.now/CVE-2013-7096.md): Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS)
- [CVE-2012-5394](https://cve.now/CVE-2012-5394.md): Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x… (no CVSS)
- [CVE-2013-0348](https://cve.now/CVE-2013-0348.md): thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to… (no CVSS)
- [CVE-2013-4567](https://cve.now/CVE-2013-4567.md): Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3… (no CVSS)
- [CVE-2013-4568](https://cve.now/CVE-2013-4568.md): Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3… (no CVSS)
- [CVE-2013-4569](https://cve.now/CVE-2013-4569.md): The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in… (no CVSS)
- [CVE-2013-6394](https://cve.now/CVE-2013-6394.md): Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat… (no CVSS)
- [CVE-2013-6956](https://cve.now/CVE-2013-6956.md): Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service… (no CVSS)
- [CVE-2013-6957](https://cve.now/CVE-2013-6957.md): Cross-site scripting (XSS) vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2013-6958](https://cve.now/CVE-2013-6958.md): Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause… (no CVSS)
- [CVE-2013-7050](https://cve.now/CVE-2013-7050.md): The get\_main\_source\_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN\_EXCLUSION, allows remote attackers to… (no CVSS)
- [CVE-2013-7091](https://cve.now/CVE-2013-7091.md): Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and… (no CVSS)
- [CVE-2013-7092](https://cve.now/CVE-2013-7092.md): Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to… (no CVSS)
- [CVE-2012-6151](https://cve.now/CVE-2012-6151.md): Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a… (no CVSS)
- [CVE-2013-5676](https://cve.now/CVE-2013-5676.md): The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords)… (no CVSS, org.jenkins-ci.plugins:sonar)
- [CVE-2013-6048](https://cve.now/CVE-2013-6048.md): The get\_group\_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service… (no CVSS)
- [CVE-2013-6359](https://cve.now/CVE-2013-6359.md): Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a… (no CVSS)
- [CVE-2013-6400](https://cve.now/CVE-2013-6400.md): Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes… (no CVSS)
- [CVE-2013-6809](https://cve.now/CVE-2013-6809.md): Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly… (no CVSS)
- [CVE-2013-7038](https://cve.now/CVE-2013-7038.md): The MHD\_http\_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a… (no CVSS)
- [CVE-2013-7039](https://cve.now/CVE-2013-7039.md): Stack-based buffer overflow in the MHD\_digest\_auth\_check function in libmicrohttpd before 0.9.32, when MHD\_OPTION\_CONNECTION\_MEMORY\_LIMIT… (no CVSS)
- [CVE-2013-4988](https://cve.now/CVE-2013-4988.md): Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an… (no CVSS)
- [CVE-2013-6005](https://cve.now/CVE-2013-6005.md): Cross-site scripting (XSS) vulnerability in Cybozu Dezie before 8.1.0 allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2013-6839](https://cve.now/CVE-2013-6839.md): SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2013-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.