# CVEs published 2013-04-25 28 CVEs were published on April 25, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2012-4464](https://cve.now/CVE-2012-4464.md): Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and mod (no CVSS) - [CVE-2012-4466](https://cve.now/CVE-2012-4466.md): Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass s (no CVSS) - [CVE-2013-0175](https://cve.now/CVE-2013-0175.md): multi\_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, (no CVSS, multi\_xml) - [CVE-2013-0233](https://cve.now/CVE-2013-0233.md): Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does n (no CVSS, devise) - [CVE-2013-0338](https://cve.now/CVE-2013-0338.md): libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file conta (no CVSS) - [CVE-2013-1915](https://cve.now/CVE-2013-1915.md): ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of servi (no CVSS) - [CVE-2013-1933](https://cve.now/CVE-2013-1933.md): The extract\_from\_ocr function in lib/docsplit/text\_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context (no CVSS, karteek-docsplit) - [CVE-2013-1947](https://cve.now/CVE-2013-1947.md): kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename a (no CVSS, kelredd-pruview) - [CVE-2013-1948](https://cve.now/CVE-2013-1948.md): converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (no CVSS, md2pdf) - [CVE-2013-1949](https://cve.now/CVE-2013-1949.md): Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allo (no CVSS) - [CVE-2013-1969](https://cve.now/CVE-2013-1969.md): Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a deni (no CVSS) - [CVE-2013-1215](https://cve.now/CVE-2013-1215.md): The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local users to gain privileg (no CVSS) - [CVE-2013-2696](https://cve.now/CVE-2013-2696.md): Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hij (no CVSS) - [CVE-2013-2767](https://cve.now/CVE-2013-2767.md): Unspecified vulnerability in Citrix NetScaler Access Gateway Enterprise Edition (AGEE) before 9.3.62.4 and 10.x through 10.0.74.4, and NetSc (no CVSS) - [CVE-2013-1178](https://cve.now/CVE-2013-1178.md): Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4 (no CVSS) - [CVE-2013-1179](https://cve.now/CVE-2013-1179.md): Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5. (no CVSS) - [CVE-2013-1180](https://cve.now/CVE-2013-1180.md): Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 (no CVSS) - [CVE-2013-1181](https://cve.now/CVE-2013-1181.md): Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unified Computing System (U (no CVSS) - [CVE-2013-1182](https://cve.now/CVE-2013-1182.md): The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1 (no CVSS) - [CVE-2013-1183](https://cve.now/CVE-2013-1183.md): Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing Sy (no CVSS) - [CVE-2013-1184](https://cve.now/CVE-2013-1184.md): The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) all (no CVSS) - [CVE-2013-1185](https://cve.now/CVE-2013-1185.md): The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obt (no CVSS) - [CVE-2013-1186](https://cve.now/CVE-2013-1186.md): Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM authentication via a cra (no CVSS) - [CVE-2013-1192](https://cve.now/CVE-2013-1192.md): The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow (no CVSS) - [CVE-2013-2305](https://cve.now/CVE-2013-2305.md): Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Ma (no CVSS) - [CVE-2013-3269](https://cve.now/CVE-2013-3269.md): Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the aut (no CVSS) - [CVE-2013-0728](https://cve.now/CVE-2013-0728.md): Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and (no CVSS) - [CVE-2013-3055](https://cve.now/CVE-2013-3055.md): Lexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789, which allows remote attackers to execute arbitrar (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-04-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.