# CVEs published 2013-03-19 22 CVEs were published on March 19, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-1854](https://cve.now/CVE-2013-1854.md): The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by (no CVSS, activerecord) - [CVE-2013-1855](https://cve.now/CVE-2013-1855.md): The sanitize\_css method in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before (no CVSS, actionpack) - [CVE-2013-1856](https://cve.now/CVE-2013-1856.md): The ActiveSupport::XmlMini\_JDOM backend in lib/active\_support/xml\_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3. (no CVSS, activesupport) - [CVE-2013-1857](https://cve.now/CVE-2013-1857.md): The sanitize helper in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3. (no CVSS, actionpack) - [CVE-2013-0505](https://cve.now/CVE-2013-0505.md): IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote aut (no CVSS) - [CVE-2013-0506](https://cve.now/CVE-2013-0506.md): Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before F (no CVSS) - [CVE-2013-0717](https://cve.now/CVE-2013-0717.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermW (no CVSS) - [CVE-2013-1863](https://cve.now/CVE-2013-1863.md): Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares (no CVSS) - [CVE-2013-0205](https://cve.now/CVE-2013-0205.md): Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2. (no CVSS) - [CVE-2013-0206](https://cve.now/CVE-2013-0206.md): Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote aut (no CVSS) - [CVE-2013-0207](https://cve.now/CVE-2013-0207.md): Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hij (no CVSS) - [CVE-2013-0224](https://cve.now/CVE-2013-0224.md): The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by mo (no CVSS) - [CVE-2013-0225](https://cve.now/CVE-2013-0225.md): Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupa (no CVSS) - [CVE-2013-0226](https://cve.now/CVE-2013-0226.md): The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote au (no CVSS) - [CVE-2013-0227](https://cve.now/CVE-2013-0227.md): Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users (no CVSS) - [CVE-2013-0251](https://cve.now/CVE-2013-0251.md): Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service ( (no CVSS) - [CVE-2013-0327](https://cve.now/CVE-2013-0327.md): Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2013-0328](https://cve.now/CVE-2013-0328.md): Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web scri (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2013-0329](https://cve.now/CVE-2013-0329.md): Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2013-0330](https://cve.now/CVE-2013-0330.md): Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitr (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2013-0331](https://cve.now/CVE-2013-0331.md): Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted p (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2013-2263](https://cve.now/CVE-2013-2263.md): Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-03-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.