# CVEs published 2013-07-18

40 CVEs were published on July 18, 2013: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-0559](https://cve.now/CVE-2013-0559.md): Unspecified vulnerability in IBM API Management 2.0 before 2.0.0.1 allows remote attackers to access tenant APIs, and consequently obtain se (no CVSS)
- [CVE-2013-3274](https://cve.now/CVE-2013-3274.md): EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly determine authorizatio (no CVSS)
- [CVE-2013-3275](https://cve.now/CVE-2013-3275.md): EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME (no CVSS)
- [CVE-2013-3436](https://cve.now/CVE-2013-3436.md): The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group (no CVSS)
- [CVE-2012-6349](https://cve.now/CVE-2012-6349.md): Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute (no CVSS)
- [CVE-2013-4011](https://cve.now/CVE-2013-4011.md): Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to (no CVSS)
- [CVE-2013-4878](https://cve.now/CVE-2013-4878.md): The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAli (no CVSS)
- [CVE-2013-1606](https://cve.now/CVE-2013-1606.md): Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers t (no CVSS)
- [CVE-2013-3665](https://cve.now/CVE-2013-3665.md): Unspecified vulnerability in Autodesk AutoCAD through 2014, AutoCAD LT through 2014, and DWG TrueView through 2014 allows remote attackers t (no CVSS)
- [CVE-2013-4668](https://cve.now/CVE-2013-4668.md): Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, al (no CVSS)
- [CVE-2013-4778](https://cve.now/CVE-2013-4778.md): core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 b (no CVSS)
- [CVE-2013-4779](https://cve.now/CVE-2013-4779.md): Cross-site scripting (XSS) vulnerability in core/handleTw.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Bor (no CVSS)
- [CVE-2013-4780](https://cve.now/CVE-2013-4780.md): core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 b (no CVSS)
- [CVE-2013-4781](https://cve.now/CVE-2013-4781.md): core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 b (no CVSS)
- [CVE-2013-4872](https://cve.now/CVE-2013-4872.md): Google Glass before XE6 does not properly restrict the processing of QR codes, which allows physically proximate attackers to modify the con (no CVSS)
- [CVE-2013-4873](https://cve.now/CVE-2013-4873.md): The Yahoo! Tumblr app before 3.4.1 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sni (no CVSS)
- [CVE-2013-4874](https://cve.now/CVE-2013-4874.md): The Uboot bootloader on the Verizon Wireless Network Extender SCS-26UC4 allows physically proximate attackers to obtain root access by conne (no CVSS)
- [CVE-2013-4875](https://cve.now/CVE-2013-4875.md): The Uboot bootloader on the Verizon Wireless Network Extender SCS-2U01 allows physically proximate attackers to bypass the intended boot pro (no CVSS)
- [CVE-2013-4876](https://cve.now/CVE-2013-4876.md): The Verizon Wireless Network Extender SCS-2U01 has a hardcoded password for the root account, which makes it easier for physically proximate (no CVSS)
- [CVE-2013-4877](https://cve.now/CVE-2013-4877.md): The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE authentication, which makes it easier for remote attackers to (no CVSS)
- [CVE-2013-1879](https://cve.now/CVE-2013-1879.md): Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary w (no CVSS, org.apache.activemq:activemq-client)
- [CVE-2013-1955](https://cve.now/CVE-2013-1955.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 a (no CVSS)
- [CVE-2013-2028](https://cve.now/CVE-2013-2028.md): The ngx\_http\_parse\_chunked function in http/ngx\_http\_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2013-2070](https://cve.now/CVE-2013-2070.md): http/modules/ngx\_http\_proxy\_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy\_pass is used with untrusted HTTP serve (no CVSS)
- [CVE-2013-2248](https://cve.now/CVE-2013-2248.md): Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites (no CVSS, org.apache.struts:struts2-core)
- [CVE-2013-2251](https://cve.now/CVE-2013-2251.md): Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (CVSS 9.8, KEV, org.apache.struts:struts2-core)
- [CVE-2013-3656](https://cve.now/CVE-2013-3656.md): Cybozu Office 9.1.0 and earlier does not properly manage sessions, which allows remote attackers to bypass authentication by leveraging know (no CVSS)
- [CVE-2013-4870](https://cve.now/CVE-2013-4870.md): SQL injection vulnerability in the News Search (news\_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2013-4871](https://cve.now/CVE-2013-4871.md): Cross-site request forgery (CSRF) vulnerability in the TEQneers SEO Enhancements (tq\_seo) extension before 5.0.1 for TYPO3 allows remote att (no CVSS)
- [CVE-2013-1218](https://cve.now/CVE-2013-1218.md): Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software modules before 7.1(7)sp1E4 allows remote attackers to cause (no CVSS)
- [CVE-2013-1243](https://cve.now/CVE-2013-1243.md): The IP stack in Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software and hardware modules before 7.1(5)E4, IPS 45 (no CVSS)
- [CVE-2013-3402](https://cve.now/CVE-2013-3402.md): An unspecified function in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute ar (no CVSS)
- [CVE-2013-3403](https://cve.now/CVE-2013-3403.md): Multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allow local users to ga (no CVSS)
- [CVE-2013-3404](https://cve.now/CVE-2013-3404.md): SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows remote attackers to execute arbitra (no CVSS)
- [CVE-2013-3410](https://cve.now/CVE-2013-3410.md): Cisco Intrusion Prevention System (IPS) Software on IPS NME devices before 7.0(9)E4 allows remote attackers to cause a denial of service (de (no CVSS)
- [CVE-2013-3411](https://cve.now/CVE-2013-3411.md): The IDSM-2 drivers in Cisco Intrusion Prevention System (IPS) Software on Cisco Catalyst 6500 devices with an IDSM-2 module allow remote att (no CVSS)
- [CVE-2013-3412](https://cve.now/CVE-2013-3412.md): SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execut (no CVSS)
- [CVE-2013-3433](https://cve.now/CVE-2013-3433.md): Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile (no CVSS)
- [CVE-2013-3434](https://cve.now/CVE-2013-3434.md): Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile (no CVSS)
- [CVE-2013-4869](https://cve.now/CVE-2013-4869.md): Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.