# CVEs published 2013-04-09 31 CVEs were published on April 9, 2013: 0 critical, 2 high. Days are UTC. - [CVE-2013-0078](https://cve.now/CVE-2013-0078.md): The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows lo (no CVSS) - [CVE-2013-1282](https://cve.now/CVE-2013-1282.md): The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD (no CVSS) - [CVE-2013-1283](https://cve.now/CVE-2013-1283.md): Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win (no CVSS) - [CVE-2013-1284](https://cve.now/CVE-2013-1284.md): Race condition in the kernel in Microsoft Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted (no CVSS) - [CVE-2013-1289](https://cve.now/CVE-2013-1289.md): Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, an (no CVSS) - [CVE-2013-1290](https://cve.now/CVE-2013-1290.md): Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls f (no CVSS) - [CVE-2013-1291](https://cve.now/CVE-2013-1291.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Wind (no CVSS) - [CVE-2013-1292](https://cve.now/CVE-2013-1292.md): Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 G (CVSS 7.4) - [CVE-2013-1293](https://cve.now/CVE-2013-1293.md): The NTFS kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local (no CVSS) - [CVE-2013-1294](https://cve.now/CVE-2013-1294.md): Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, a (CVSS 7.0) - [CVE-2013-1295](https://cve.now/CVE-2013-1295.md): The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 does not p (no CVSS) - [CVE-2013-1296](https://cve.now/CVE-2013-1296.md): The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects (no CVSS) - [CVE-2013-1303](https://cve.now/CVE-2013-1303.md): Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web (no CVSS) - [CVE-2013-1304](https://cve.now/CVE-2013-1304.md): Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web (no CVSS) - [CVE-2013-1821](https://cve.now/CVE-2013-1821.md): lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and (no CVSS, org.jruby:jruby) - [CVE-2012-5635](https://cve.now/CVE-2012-5635.md): The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitra (no CVSS) - [CVE-2012-6097](https://cve.now/CVE-2012-6097.md): File descriptor leak in cronie 1.4.8, when running in certain environments, might allow local users to read restricted files, as demonstrate (no CVSS) - [CVE-2012-6134](https://cve.now/CVE-2012-6134.md): Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the (no CVSS, omniauth-oauth2) - [CVE-2013-0253](https://cve.now/CVE-2013-0253.md): The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers (no CVSS) - [CVE-2013-0284](https://cve.now/CVE-2013-0284.md): Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attacker (no CVSS, newrelic\_rpm) - [CVE-2013-0285](https://cve.now/CVE-2013-0285.md): The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, whic (no CVSS, nori) - [CVE-2013-1788](https://cve.now/CVE-2013-1788.md): poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vector (no CVSS) - [CVE-2013-1789](https://cve.now/CVE-2013-1789.md): splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and cras (no CVSS) - [CVE-2013-1790](https://cve.now/CVE-2013-1790.md): poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read (no CVSS) - [CVE-2013-1800](https://cve.now/CVE-2013-1800.md): The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct ob (no CVSS, crack) - [CVE-2013-1801](https://cve.now/CVE-2013-1801.md): The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct (no CVSS, httparty) - [CVE-2013-1802](https://cve.now/CVE-2013-1802.md): The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct (no CVSS, extlib) - [CVE-2013-1898](https://cve.now/CVE-2013-1898.md): lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (no CVSS, thumbshooter) - [CVE-2013-0134](https://cve.now/CVE-2013-0134.md): Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2013-0135](https://cve.now/CVE-2013-0135.md): Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS) - [CVE-2013-2778](https://cve.now/CVE-2013-2778.md): Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete\_user.php in PHP Address Book 8.2.5 allows remote attackers to (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-04-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.