# CVEs published 2013-05-23

17 CVEs were published on May 23, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4518](https://cve.now/CVE-2011-4518.md): Directory traversal vulnerability in the PmWebDir object in the web server in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to read (no CVSS)
- [CVE-2011-4519](https://cve.now/CVE-2011-4519.md): Stack-based buffer overflow in an ActiveX component in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to cause a denial of service v (no CVSS)
- [CVE-2011-4520](https://cve.now/CVE-2011-4520.md): Heap-based buffer overflow in an ActiveX component in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to cause a denial of service vi (no CVSS)
- [CVE-2012-4697](https://cve.now/CVE-2012-4697.md): TURCK BL20 Programmable Gateway and BL67 Programmable Gateway have hardcoded accounts, which allows remote attackers to obtain administrativ (no CVSS)
- [CVE-2012-6553](https://cve.now/CVE-2012-6553.md): Heap-based buffer overflow in Resource Hacker 3.6.0.92 allows remote attackers to execute arbitrary code via a Portable Executable (PE) file (no CVSS)
- [CVE-2012-6554](https://cve.now/CVE-2012-6554.md): functions/html\_to\_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code (no CVSS)
- [CVE-2012-6555](https://cve.now/CVE-2012-6555.md): Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-6556](https://cve.now/CVE-2012-6556.md): Multiple cross-site scripting (XSS) vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject a (no CVSS)
- [CVE-2012-6557](https://cve.now/CVE-2012-6557.md): Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2012-6558](https://cve.now/CVE-2012-6558.md): Heap-based buffer overflow in HeavenTools PE Explorer 1.99 R6 allows remote attackers to execute arbitrary code via the size value for a str (no CVSS)
- [CVE-2012-6559](https://cve.now/CVE-2012-6559.md): Multiple cross-site scripting (XSS) vulnerabilities in FreeNAC 3.02 allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS)
- [CVE-2012-6560](https://cve.now/CVE-2012-6560.md): SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parame (no CVSS)
- [CVE-2012-6561](https://cve.now/CVE-2012-6561.md): Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-6562](https://cve.now/CVE-2012-6562.md): engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to cre (no CVSS)
- [CVE-2012-6563](https://cve.now/CVE-2012-6563.md): engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to (no CVSS)
- [CVE-2013-1204](https://cve.now/CVE-2013-1204.md): Memory leak in the SNMP process in Cisco IOS XR allows remote attackers to cause a denial of service (memory consumption or process reload) (no CVSS)
- [CVE-2013-2781](https://cve.now/CVE-2013-2781.md): Use-after-free vulnerability in the server application in 3S CODESYS Gateway 2.3.9.27 allows remote attackers to cause a denial of service ( (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.