# CVEs published 2013-07-31

43 CVEs were published on July 31, 2013: 0 critical, 1 high. Days are UTC.

- [CVE-2012-5460](https://cve.now/CVE-2012-5460.md): Cross-site scripting (XSS) vulnerability in the help page in Juniper Secure Access (SA) with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7 (no CVSS)
- [CVE-2013-3724](https://cve.now/CVE-2013-3724.md): The mk\_request\_header\_process function in mk\_request.c in Monkey 1.1.1 allows remote attackers to cause a denial of service (thread crash an (no CVSS)
- [CVE-2012-3913](https://cve.now/CVE-2012-3913.md): The Cisco VC220 and VC240 cameras allow remote attackers to cause a denial of service (WebUI outage) via crafted packets, aka Bug IDs CSCtf7 (no CVSS)
- [CVE-2013-3443](https://cve.now/CVE-2013-3443.md): The web service framework in Cisco WAAS Software 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1 in a Central Manager (no CVSS)
- [CVE-2013-3444](https://cve.now/CVE-2013-3444.md): The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1; Cisco ACNS Software (no CVSS)
- [CVE-2013-2994](https://cve.now/CVE-2013-2994.md): IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST s (no CVSS)
- [CVE-2013-4651](https://cve.now/CVE-2013-4651.md): Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, (no CVSS)
- [CVE-2013-4652](https://cve.now/CVE-2013-4652.md): Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote (no CVSS)
- [CVE-2013-4911](https://cve.now/CVE-2013-4911.md): Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the (no CVSS)
- [CVE-2013-4912](https://cve.now/CVE-2013-4912.md): Open redirect vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web (no CVSS)
- [CVE-2013-1616](https://cve.now/CVE-2013-1616.md): The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by inj (no CVSS)
- [CVE-2013-1617](https://cve.now/CVE-2013-1617.md): Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote authe (no CVSS)
- [CVE-2013-4670](https://cve.now/CVE-2013-4670.md): Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow (no CVSS)
- [CVE-2013-4671](https://cve.now/CVE-2013-4671.md): Cross-site request forgery (CSRF) vulnerability in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows re (no CVSS)
- [CVE-2013-4672](https://cve.now/CVE-2013-4672.md): The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect sudoers file, which allows local users to b (no CVSS)
- [CVE-2013-4673](https://cve.now/CVE-2013-4673.md): The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which all (no CVSS)
- [CVE-2013-2993](https://cve.now/CVE-2013-2993.md): IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, w (no CVSS)
- [CVE-2013-0943](https://cve.now/CVE-2013-0943.md): EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privi (no CVSS)
- [CVE-2013-1968](https://cve.now/CVE-2013-1968.md): Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) (no CVSS)
- [CVE-2013-2056](https://cve.now/CVE-2013-2056.md): Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass (CVSS 7.5, Red Hat Network Satellite Server v · Red Hat Satellite)
- [CVE-2013-2088](https://cve.now/CVE-2013-2088.md): contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute a (no CVSS)
- [CVE-2013-2112](https://cve.now/CVE-2013-2112.md): The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by abort (no CVSS)
- [CVE-2013-2113](https://cve.now/CVE-2013-2113.md): The create method in app/controllers/users\_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to c (no CVSS)
- [CVE-2013-2121](https://cve.now/CVE-2013-2121.md): Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users (no CVSS)
- [CVE-2013-2174](https://cve.now/CVE-2013-2174.md): Heap-based buffer overflow in the curl\_easy\_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers (no CVSS)
- [CVE-2013-2189](https://cve.now/CVE-2013-2189.md): Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified (no CVSS)
- [CVE-2013-2209](https://cve.now/CVE-2013-2209.md): Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 an (no CVSS, reviewboard)
- [CVE-2013-2219](https://cve.now/CVE-2013-2219.md): The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows re (no CVSS)
- [CVE-2013-2220](https://cve.now/CVE-2013-2220.md): Buffer overflow in the radius\_get\_vendor\_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denia (no CVSS)
- [CVE-2013-2630](https://cve.now/CVE-2013-2630.md): Cross-site scripting (XSS) vulnerability in CA Service Desk Manager 12.5 through 12.7 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2013-2785](https://cve.now/CVE-2013-2785.md): Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 (no CVSS)
- [CVE-2013-3697](https://cve.now/CVE-2013-3697.md): Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003 and the NCPL.SYS ker (no CVSS)
- [CVE-2013-3956](https://cve.now/CVE-2013-3956.md): The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista an (no CVSS)
- [CVE-2013-4131](https://cve.now/CVE-2013-4131.md): The mod\_dav\_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to ca (no CVSS)
- [CVE-2013-4156](https://cve.now/CVE-2013-4156.md): Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified (no CVSS)
- [CVE-2013-4674](https://cve.now/CVE-2013-4674.md): Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec P (no CVSS)
- [CVE-2013-5019](https://cve.now/CVE-2013-5019.md): Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP r (no CVSS)
- [CVE-2013-5020](https://cve.now/CVE-2013-5020.md): Multiple cross-site scripting (XSS) vulnerabilities in bb\_admin.php in MiniBB before 3.0.1 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2013-1377](https://cve.now/CVE-2013-1377.md): Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unsp (no CVSS)
- [CVE-2013-2367](https://cve.now/CVE-2013-2367.md): Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2013-3425](https://cve.now/CVE-2013-3425.md): The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a fi (no CVSS)
- [CVE-2013-4697](https://cve.now/CVE-2013-4697.md): Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 th (no CVSS)
- [CVE-2013-5006](https://cve.now/CVE-2013-5006.md): main\_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.1 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.