# CVEs published 2013-05-13

15 CVEs were published on May 13, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1897](https://cve.now/CVE-2013-1897.md): The do\_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not prope (no CVSS)
- [CVE-2013-1917](https://cve.now/CVE-2013-1917.md): Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, wh (no CVSS)
- [CVE-2013-1918](https://cve.now/CVE-2013-1918.md): Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a de (no CVSS)
- [CVE-2013-1919](https://cve.now/CVE-2013-1919.md): Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a den (no CVSS)
- [CVE-2013-1922](https://cve.now/CVE-2013-1922.md): qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administr (no CVSS)
- [CVE-2013-1940](https://cve.now/CVE-2013-1940.md): X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, wh (no CVSS)
- [CVE-2013-1952](https://cve.now/CVE-2013-1952.md): Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's i (no CVSS)
- [CVE-2013-2020](https://cve.now/CVE-2013-2020.md): Integer underflow in the cli\_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) vi (no CVSS)
- [CVE-2013-2021](https://cve.now/CVE-2013-2021.md): pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value i (no CVSS)
- [CVE-2013-3534](https://cve.now/CVE-2013-3534.md): Cross-site scripting (XSS) vulnerability in the aiContactSafe component before 2.0.21 for Joomla! allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2013-3535](https://cve.now/CVE-2013-3535.md): Multiple cross-site scripting (XSS) vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2013-3536](https://cve.now/CVE-2013-3536.md): SQL injection vulnerability in the gp\_LoadUserFromHash function in functions\_hash.php in the Group Pay module 1.5 and earlier for WHMCS allo (no CVSS)
- [CVE-2013-3537](https://cve.now/CVE-2013-3537.md): Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2013-3538](https://cve.now/CVE-2013-3538.md): Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2013-1136](https://cve.now/CVE-2013-1136.md): The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.