# CVEs published 2013-05-02

21 CVEs were published on May 2, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-0535](https://cve.now/CVE-2013-0535.md): Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authe (no CVSS)
- [CVE-2013-0582](https://cve.now/CVE-2013-0582.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6. (no CVSS)
- [CVE-2013-1091](https://cve.now/CVE-2013-1091.md): Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2009-5029](https://cve.now/CVE-2009-5029.md): Integer overflow in the \_\_tzfile\_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2011-4609](https://cve.now/CVE-2011-4609.md): The svc\_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) v (no CVSS)
- [CVE-2012-0864](https://cve.now/CVE-2012-0864.md): Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to (no CVSS)
- [CVE-2012-4481](https://cve.now/CVE-2012-4481.md): The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to\_s method when operating on Ru (no CVSS)
- [CVE-2012-5657](https://cve.now/CVE-2012-5657.md): The (1) Zend\_Feed\_Rss and (2) Zend\_Feed\_Atom classes in Zend\_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow rem (no CVSS, zendframework/zendframework1)
- [CVE-2013-0305](https://cve.now/CVE-2013-0305.md): The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permission (no CVSS, django)
- [CVE-2013-0306](https://cve.now/CVE-2013-0306.md): The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass inte (no CVSS, django)
- [CVE-2013-1845](https://cve.now/CVE-2013-1845.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to ca (no CVSS)
- [CVE-2013-1846](https://cve.now/CVE-2013-1846.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to ca (no CVSS)
- [CVE-2013-1847](https://cve.now/CVE-2013-1847.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a den (no CVSS)
- [CVE-2013-1849](https://cve.now/CVE-2013-1849.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a den (no CVSS)
- [CVE-2013-1884](https://cve.now/CVE-2013-1884.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentat (no CVSS)
- [CVE-2013-2944](https://cve.now/CVE-2013-2944.md): strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as o (no CVSS)
- [CVE-2009-5135](https://cve.now/CVE-2009-5135.md): The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an e (no CVSS)
- [CVE-2013-3266](https://cve.now/CVE-2013-3266.md): The nfsrvd\_readdir function in sys/fs/nfsserver/nfs\_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify t (no CVSS)
- [CVE-2012-5222](https://cve.now/CVE-2012-5222.md): HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors. (no CVSS)
- [CVE-2013-1338](https://cve.now/CVE-2013-1338.md): Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web (no CVSS)
- [CVE-2013-2321](https://cve.now/CVE-2013-2321.md): Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to inject arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.