# CVEs published 2013-07-08

22 CVEs were published on July 8, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4782](https://cve.now/CVE-2013-4782.md): The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite (no CVSS)
- [CVE-2013-4783](https://cve.now/CVE-2013-4783.md): The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers (no CVSS)
- [CVE-2013-4784](https://cve.now/CVE-2013-4784.md): The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands b (no CVSS)
- [CVE-2013-4785](https://cve.now/CVE-2013-4785.md): The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and p (no CVSS)
- [CVE-2013-4786](https://cve.now/CVE-2013-4786.md): The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain (no CVSS)
- [CVE-2013-0235](https://cve.now/CVE-2013-0235.md): The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack (no CVSS)
- [CVE-2013-0236](https://cve.now/CVE-2013-0236.md): Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-0237](https://cve.now/CVE-2013-0237.md): Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod (no CVSS)
- [CVE-2013-2199](https://cve.now/CVE-2013-2199.md): The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to (no CVSS)
- [CVE-2013-2200](https://cve.now/CVE-2013-2200.md): WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric (no CVSS)
- [CVE-2013-2201](https://cve.now/CVE-2013-2201.md): Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-2202](https://cve.now/CVE-2013-2202.md): WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec (no CVSS)
- [CVE-2013-2203](https://cve.now/CVE-2013-2203.md): WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva (no CVSS)
- [CVE-2013-2204](https://cve.now/CVE-2013-2204.md): moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider (no CVSS)
- [CVE-2013-2205](https://cve.now/CVE-2013-2205.md): The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta (no CVSS)
- [CVE-2013-3272](https://cve.now/CVE-2013-3272.md): EMC Replication Manager (RM) before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain (no CVSS)
- [CVE-2013-3273](https://cve.now/CVE-2013-3273.md): EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative pa (no CVSS)
- [CVE-2013-1059](https://cve.now/CVE-2013-1059.md): net/ceph/auth\_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and sys (no CVSS)
- [CVE-2013-1414](https://cve.now/CVE-2013-1414.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5. (no CVSS)
- [CVE-2013-1613](https://cve.now/CVE-2013-1613.md): SQL injection vulnerability in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x (no CVSS)
- [CVE-2013-1614](https://cve.now/CVE-2013-1614.md): Multiple cross-site scripting (XSS) vulnerabilities in the management console (aka Java console) on the Symantec Security Information Manage (no CVSS)
- [CVE-2013-1615](https://cve.now/CVE-2013-1615.md): The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.