# CVEs published 2013-12-23 22 CVEs were published on December 23, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-3709](https://cve.now/CVE-2013-3709.md): WebYaST 1.3 uses weak permissions for config/initializers/secret\_token.rb, which allows local users to gain privileges by reading the… (no CVSS) - [CVE-2013-4424](https://cve.now/CVE-2013-4424.md): Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to… (no CVSS) - [CVE-2013-7049](https://cve.now/CVE-2013-7049.md): Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote… (no CVSS) - [CVE-2013-7073](https://cve.now/CVE-2013-7073.md): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6… (no CVSS, typo3/cms) - [CVE-2013-7075](https://cve.now/CVE-2013-7075.md): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6… (no CVSS, typo3/cms) - [CVE-2013-7079](https://cve.now/CVE-2013-7079.md): Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0… (no CVSS, friendsoftypo3/openid) - [CVE-2013-7080](https://cve.now/CVE-2013-7080.md): The creating record functionality in Extension table administration library (feuser\_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0… (no CVSS, typo3/cms-core) - [CVE-2013-7081](https://cve.now/CVE-2013-7081.md): The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through… (no CVSS, typo3/cms-core) - [CVE-2013-7102](https://cve.now/CVE-2013-7102.md): Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3)… (no CVSS) - [CVE-2013-4404](https://cve.now/CVE-2013-4404.md): cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended… (no CVSS) - [CVE-2013-4405](https://cve.now/CVE-2013-4405.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote… (no CVSS) - [CVE-2013-4414](https://cve.now/CVE-2013-4414.md): Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to… (no CVSS) - [CVE-2013-4461](https://cve.now/CVE-2013-4461.md): SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary… (no CVSS) - [CVE-2013-4549](https://cve.now/CVE-2013-4549.md): QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity… (no CVSS) - [CVE-2013-5420](https://cve.now/CVE-2013-5420.md): The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated… (no CVSS) - [CVE-2013-6422](https://cve.now/CVE-2013-6422.md): The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT\_SSL\_VERIFYPEER), also disables… (no CVSS) - [CVE-2013-6439](https://cve.now/CVE-2013-6439.md): Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not… (no CVSS) - [CVE-2013-6449](https://cve.now/CVE-2013-6449.md): The ssl\_get\_algorithm2 function in ssl/s3\_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure… (no CVSS) - [CVE-2013-6890](https://cve.now/CVE-2013-6890.md): denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of… (no CVSS) - [CVE-2013-6979](https://cve.now/CVE-2013-6979.md): The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network… (no CVSS) - [CVE-2013-2629](https://cve.now/CVE-2013-2629.md): Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm… (no CVSS) - [CVE-2013-5973](https://cve.now/CVE-2013-5973.md): VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2013-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.