# CVEs published 2013-07-10

71 CVEs were published on July 10, 2013: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-2352](https://cve.now/CVE-2013-2352.md): LeftHand OS (aka SAN iQ) 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support chall (no CVSS)
- [CVE-2013-2784](https://cve.now/CVE-2013-2784.md): Triangle Research International (aka Tri) Nano-10 PLC devices with firmware before r81 use an incorrect algorithm for bounds checking of dat (no CVSS)
- [CVE-2013-2786](https://cve.now/CVE-2013-2786.md): Alstom Grid MiCOM S1 Agile before 1.0.3 and Alstom Grid MiCOM S1 Studio use weak permissions for the MiCOM S1 %PROGRAMFILES% directory, whic (no CVSS)
- [CVE-2013-1132](https://cve.now/CVE-2013-1132.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2013-3408](https://cve.now/CVE-2013-3408.md): The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to (no CVSS)
- [CVE-2013-3416](https://cve.now/CVE-2013-3416.md): Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Opera (no CVSS)
- [CVE-2013-3579](https://cve.now/CVE-2013-3579.md): The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash) vi (no CVSS)
- [CVE-2013-1896](https://cve.now/CVE-2013-1896.md): mod\_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attacker (no CVSS)
- [CVE-2013-3400](https://cve.now/CVE-2013-3400.md): The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users to execute arbitrary commands via crafted "install (no CVSS)
- [CVE-2013-3405](https://cve.now/CVE-2013-3405.md): The web portal in TC software on Cisco TelePresence endpoints does not require an exact password match during a login attempt by a user who (no CVSS)
- [CVE-2012-5855](https://cve.now/CVE-2012-5855.md): The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of servi (no CVSS)
- [CVE-2013-1868](https://cve.now/CVE-2013-1868.md): Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and exe (no CVSS)
- [CVE-2013-1954](https://cve.now/CVE-2013-1954.md): The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2013-1965](https://cve.now/CVE-2013-1965.md): Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code (no CVSS, org.apache.struts:struts2-core)
- [CVE-2013-1966](https://cve.now/CVE-2013-1966.md): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled wh (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…)
- [CVE-2013-2115](https://cve.now/CVE-2013-2115.md): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled wh (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…)
- [CVE-2013-3245](https://cve.now/CVE-2013-3245.md): plugins/demux/libmkv\_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial o (CVSS 6.3)
- [CVE-2013-2853](https://cve.now/CVE-2013-2853.md): The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \\r\\n\\r\\n (carriage return, newl (no CVSS)
- [CVE-2013-2867](https://cve.now/CVE-2013-2867.md): Google Chrome before 28.0.1500.71 does not properly prevent pop-under windows, which allows remote attackers to have an unspecified impact v (no CVSS)
- [CVE-2013-2868](https://cve.now/CVE-2013-2868.md): common/extensions/sync\_helper.cc in Google Chrome before 28.0.1500.71 proceeds with sync operations for NPAPI extensions without checking fo (no CVSS)
- [CVE-2013-2869](https://cve.now/CVE-2013-2869.md): Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image. (no CVSS)
- [CVE-2013-2870](https://cve.now/CVE-2013-2870.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traff (no CVSS)
- [CVE-2013-2871](https://cve.now/CVE-2013-2871.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2013-2872](https://cve.now/CVE-2013-2872.md): Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it eas (no CVSS)
- [CVE-2013-2873](https://cve.now/CVE-2013-2873.md): Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2013-2874](https://cve.now/CVE-2013-2874.md): Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access (no CVSS)
- [CVE-2013-2875](https://cve.now/CVE-2013-2875.md): core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote atta (no CVSS)
- [CVE-2013-2876](https://cve.now/CVE-2013-2876.md): browser/extensions/api/tabs/tabs\_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of screen (no CVSS)
- [CVE-2013-2877](https://cve.now/CVE-2013-2877.md): parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial (no CVSS)
- [CVE-2013-2878](https://cve.now/CVE-2013-2878.md): Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handl (no CVSS)
- [CVE-2013-2879](https://cve.now/CVE-2013-2879.md): Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted proc (no CVSS)
- [CVE-2013-2880](https://cve.now/CVE-2013-2880.md): Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2013-3344](https://cve.now/CVE-2013-3344.md): Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202. (no CVSS)
- [CVE-2013-3345](https://cve.now/CVE-2013-3345.md): Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111. (no CVSS)
- [CVE-2013-3347](https://cve.now/CVE-2013-3347.md): Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Lin (no CVSS)
- [CVE-2013-3348](https://cve.now/CVE-2013-3348.md): Adobe Shockwave Player before 12.0.3.133 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2013-3349](https://cve.now/CVE-2013-3349.md): Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause (no CVSS)
- [CVE-2013-3350](https://cve.now/CVE-2013-3350.md): Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets. (no CVSS)
- [CVE-2013-1300](https://cve.now/CVE-2013-1300.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (no CVSS)
- [CVE-2013-1340](https://cve.now/CVE-2013-1340.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (CVSS 8.4)
- [CVE-2013-1345](https://cve.now/CVE-2013-1345.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (no CVSS)
- [CVE-2013-3115](https://cve.now/CVE-2013-3115.md): Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3127](https://cve.now/CVE-2013-3127.md): The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Forma (no CVSS)
- [CVE-2013-3129](https://cve.now/CVE-2013-3129.md): Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, (CVSS 7.8)
- [CVE-2013-3131](https://cve.now/CVE-2013-3131.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in (no CVSS)
- [CVE-2013-3132](https://cve.now/CVE-2013-3132.md): Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use refle (no CVSS)
- [CVE-2013-3133](https://cve.now/CVE-2013-3133.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allow (no CVSS)
- [CVE-2013-3134](https://cve.now/CVE-2013-3134.md): The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate (no CVSS)
- [CVE-2013-3143](https://cve.now/CVE-2013-3143.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2013-3144](https://cve.now/CVE-2013-3144.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3145](https://cve.now/CVE-2013-3145.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2013-3146](https://cve.now/CVE-2013-3146.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3147](https://cve.now/CVE-2013-3147.md): Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v (no CVSS)
- [CVE-2013-3148](https://cve.now/CVE-2013-3148.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3149](https://cve.now/CVE-2013-3149.md): Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2013-3150](https://cve.now/CVE-2013-3150.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2013-3151](https://cve.now/CVE-2013-3151.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3152](https://cve.now/CVE-2013-3152.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2013-3153](https://cve.now/CVE-2013-3153.md): Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3154](https://cve.now/CVE-2013-3154.md): The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, wh (no CVSS)
- [CVE-2013-3161](https://cve.now/CVE-2013-3161.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2013-3162](https://cve.now/CVE-2013-3162.md): Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3163](https://cve.now/CVE-2013-3163.md): Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (CVSS 8.8, KEV)
- [CVE-2013-3164](https://cve.now/CVE-2013-3164.md): Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2013-3166](https://cve.now/CVE-2013-3166.md): Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2013-3167](https://cve.now/CVE-2013-3167.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (no CVSS)
- [CVE-2013-3171](https://cve.now/CVE-2013-3171.md): The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions (no CVSS)
- [CVE-2013-3172](https://cve.now/CVE-2013-3172.md): Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Wi (no CVSS)
- [CVE-2013-3173](https://cve.now/CVE-2013-3173.md): Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Wi (no CVSS)
- [CVE-2013-3174](https://cve.now/CVE-2013-3174.md): DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP (no CVSS)
- [CVE-2013-3178](https://cve.now/CVE-2013-3178.md): Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.