# CVEs published 2013-03-20 29 CVEs were published on March 20, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-1875](https://cve.now/CVE-2013-1875.md): command\_wrap.rb in the command\_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or (no CVSS, command\_wrap) - [CVE-2013-2615](https://cve.now/CVE-2013-2615.md): lib/entry\_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters (no CVSS, fastreader) - [CVE-2013-2616](https://cve.now/CVE-2013-2616.md): lib/mini\_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (no CVSS, mini\_magick) - [CVE-2013-2617](https://cve.now/CVE-2013-2617.md): lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. (no CVSS, curl) - [CVE-2013-0711](https://cve.now/CVE-2013-0711.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a (no CVSS) - [CVE-2013-0712](https://cve.now/CVE-2013-0712.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outa (no CVSS) - [CVE-2013-0713](https://cve.now/CVE-2013-0713.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outa (no CVSS) - [CVE-2013-0714](https://cve.now/CVE-2013-0714.md): IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS) - [CVE-2013-0715](https://cve.now/CVE-2013-0715.md): The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash (no CVSS) - [CVE-2013-0716](https://cve.now/CVE-2013-0716.md): The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI. (no CVSS) - [CVE-2013-1750](https://cve.now/CVE-2013-1750.md): Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execut (no CVSS) - [CVE-2013-1640](https://cve.now/CVE-2013-1640.md): The (1) template and (2) inline\_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1 (no CVSS) - [CVE-2013-1652](https://cve.now/CVE-2013-1652.md): Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote a (no CVSS) - [CVE-2013-1653](https://cve.now/CVE-2013-1653.md): Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening (no CVSS) - [CVE-2013-1654](https://cve.now/CVE-2013-1654.md): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol be (no CVSS) - [CVE-2013-1655](https://cve.now/CVE-2013-1655.md): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via v (no CVSS, puppet) - [CVE-2013-2274](https://cve.now/CVE-2013-2274.md): Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppe (no CVSS) - [CVE-2013-2275](https://cve.now/CVE-2013-2275.md): The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Pupp (no CVSS) - [CVE-2013-0232](https://cve.now/CVE-2013-0232.md): includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shel (no CVSS) - [CVE-2013-0332](https://cve.now/CVE-2013-0332.md): Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2013-1766](https://cve.now/CVE-2013-1766.md): libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vec (no CVSS) - [CVE-2013-1842](https://cve.now/CVE-2013-1842.md): SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before (no CVSS, typo3/cms-core) - [CVE-2013-1843](https://cve.now/CVE-2013-1843.md): Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0. (no CVSS, typo3/cms-core) - [CVE-2012-5938](https://cve.now/CVE-2012-5938.md): The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and owners (no CVSS) - [CVE-2013-0977](https://cve.now/CVE-2013-0977.md): dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, whi (no CVSS) - [CVE-2013-0978](https://cve.now/CVE-2013-0978.md): The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in (no CVSS) - [CVE-2013-0979](https://cve.now/CVE-2013-0979.md): lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restora (no CVSS) - [CVE-2013-0980](https://cve.now/CVE-2013-0980.md): The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attack (no CVSS) - [CVE-2013-0981](https://cve.now/CVE-2013-0981.md): The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe objec (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-03-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.