# CVEs published 2013-03-08

16 CVEs were published on March 8, 2013: 0 critical, 1 high. Days are UTC.

- [CVE-2011-2504](https://cve.now/CVE-2011-2504.md): Untrusted search path vulnerability in x11perfcomp in XFree86 x11perf before 1.5.4 allows local users to gain privileges via unspecified Tro (no CVSS)
- [CVE-2011-4969](https://cve.now/CVE-2011-4969.md): Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inj (no CVSS, jquery · jquery-rails +1)
- [CVE-2013-0249](https://cve.now/CVE-2013-0249.md): Stack-based buffer overflow in the Curl\_sasl\_create\_digest\_md5\_message function in lib/curl\_sasl.c in curl and libcurl 7.26.0 through 7.28.1 (no CVSS)
- [CVE-2013-1050](https://cve.now/CVE-2013-1050.md): The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, w (no CVSS)
- [CVE-2011-3201](https://cve.now/CVE-2011-3201.md): GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, wh (no CVSS)
- [CVE-2013-0261](https://cve.now/CVE-2013-0261.md): Packstack: packstack: arbitrary file overwrite via symlink attack (CVSS 8.8, Red Hat OpenStack Folsom for RHEL · Red Hat Enterprise L… +1)
- [CVE-2013-0266](https://cve.now/CVE-2013-0266.md): Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to… (CVSS 5.5, Red Hat OpenStack Folsom for RHEL · Red Hat Enterprise L… +1)
- [CVE-2013-0308](https://cve.now/CVE-2013-0308.md): The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) (no CVSS)
- [CVE-2012-4066](https://cve.now/CVE-2012-4066.md): The internal message protocol for Walrus in Eucalyptus 3.2.0 and earlier does not require signatures for unspecified request headers, which (no CVSS)
- [CVE-2013-0401](https://cve.now/CVE-2013-0401.md): The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earli (no CVSS)
- [CVE-2013-0402](https://cve.now/CVE-2013-0402.md): Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and ea (no CVSS)
- [CVE-2013-1488](https://cve.now/CVE-2013-1488.md): The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to exec (no CVSS)
- [CVE-2013-1491](https://cve.now/CVE-2013-1491.md): The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, (no CVSS)
- [CVE-2013-1656](https://cve.now/CVE-2013-1656.md): Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary co (no CVSS, spree)
- [CVE-2013-1762](https://cve.now/CVE-2013-1762.md): stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer convers (no CVSS)
- [CVE-2013-2506](https://cve.now/CVE-2013-2506.md): app/models/spree/user.rb in spree\_auth\_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when upd (no CVSS, spree\_auth\_devise)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.