# CVEs published 2013-01-09

15 CVEs were published on January 9, 2013: 1 critical, 3 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2013-0001](https://cve.now/CVE-2013-0001.md): The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly init (no CVSS)
- [CVE-2013-0002](https://cve.now/CVE-2013-0002.md): Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, (no CVSS)
- [CVE-2013-0003](https://cve.now/CVE-2013-0003.md): Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, (no CVSS)
- [CVE-2013-0004](https://cve.now/CVE-2013-0004.md): Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in (no CVSS)
- [CVE-2013-0005](https://cve.now/CVE-2013-0005.md): The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and th (no CVSS)
- [CVE-2013-0006](https://cve.now/CVE-2013-0006.md): Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi (CVSS 8.8)
- [CVE-2013-0007](https://cve.now/CVE-2013-0007.md): Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi (no CVSS)
- [CVE-2013-0008](https://cve.now/CVE-2013-0008.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windo (no CVSS)
- [CVE-2013-0009](https://cve.now/CVE-2013-0009.md): Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb (no CVSS)
- [CVE-2013-0010](https://cve.now/CVE-2013-0010.md): Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb (no CVSS)
- [CVE-2013-0011](https://cve.now/CVE-2013-0011.md): The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2013-0013](https://cve.now/CVE-2013-0013.md): The SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windo (no CVSS)
- [CVE-2013-0625](https://cve.now/CVE-2013-0625.md): Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe (CVSS 9.8, KEV)
- [CVE-2013-0629](https://cve.now/CVE-2013-0629.md): Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci (CVSS 7.5, KEV)
- [CVE-2013-0631](https://cve.now/CVE-2013-0631.md): Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in (CVSS 7.5, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.