# CVEs published 2013-08-20 30 CVEs were published on August 20, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-2153](https://cve.now/CVE-2013-2153.md): The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1 (no CVSS) - [CVE-2013-2154](https://cve.now/CVE-2013-2154.md): Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for (no CVSS) - [CVE-2013-2155](https://cve.now/CVE-2013-2155.md): Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attack (no CVSS) - [CVE-2013-2156](https://cve.now/CVE-2013-2156.md): Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Securit (no CVSS) - [CVE-2013-2157](https://cve.now/CVE-2013-2157.md): OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass au (no CVSS) - [CVE-2013-2161](https://cve.now/CVE-2013-2161.md): XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofe (no CVSS, swift) - [CVE-2013-2172](https://cve.now/CVE-2013-2172.md): jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 (no CVSS, org.apache.santuario:xmlsec) - [CVE-2013-2210](https://cve.now/CVE-2013-2210.md): Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before (no CVSS) - [CVE-2013-4130](https://cve.now/CVE-2013-4130.md): The (1) red\_channel\_pipes\_add\_type and (2) red\_channel\_pipes\_add\_empty\_msg functions in server/red\_channel.c in SPICE before 0.12.4 do not p (no CVSS) - [CVE-2013-4155](https://cve.now/CVE-2013-4155.md): OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone (no CVSS, swift) - [CVE-2013-4761](https://cve.now/CVE-2013-4761.md): Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3. (no CVSS, puppet) - [CVE-2013-4762](https://cve.now/CVE-2013-4762.md): Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack (no CVSS) - [CVE-2013-4955](https://cve.now/CVE-2013-4955.md): Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web s (no CVSS) - [CVE-2013-4956](https://cve.now/CVE-2013-4956.md): Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x b (no CVSS) - [CVE-2013-4958](https://cve.now/CVE-2013-4958.md): Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unatt (no CVSS) - [CVE-2013-4959](https://cve.now/CVE-2013-4959.md): Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow loca (no CVSS) - [CVE-2013-4961](https://cve.now/CVE-2013-4961.md): Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, whic (no CVSS) - [CVE-2013-4962](https://cve.now/CVE-2013-4962.md): The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify use (no CVSS) - [CVE-2013-4964](https://cve.now/CVE-2013-4964.md): Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote att (no CVSS) - [CVE-2013-4967](https://cve.now/CVE-2013-4967.md): Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as (no CVSS) - [CVE-2012-6582](https://cve.now/CVE-2012-6582.md): Cross-site scripting (XSS) vulnerability in the Spambot module 6.x-3.x before 6.x-3.2 and 7.x-1.x before 7.x-1.1 for Drupal allows certain r (no CVSS) - [CVE-2013-5322](https://cve.now/CVE-2013-5322.md): SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via u (no CVSS, bednee/cooluri) - [CVE-2013-5323](https://cve.now/CVE-2013-5323.md): Cross-site scripting (XSS) vulnerability in the Static Info Tables (static\_info\_tables) extension before 2.3.1 for TYPO3 allows remote attac (no CVSS, sjbr/static-info-tables) - [CVE-2013-5316](https://cve.now/CVE-2013-5316.md): Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for (no CVSS) - [CVE-2013-5317](https://cve.now/CVE-2013-5317.md): Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the m (no CVSS) - [CVE-2013-5318](https://cve.now/CVE-2013-5318.md): SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang parameter to index.php. (no CVSS) - [CVE-2013-5319](https://cve.now/CVE-2013-5319.md): Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 (no CVSS) - [CVE-2013-5320](https://cve.now/CVE-2013-5320.md): Cross-site scripting (XSS) vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2013-5321](https://cve.now/CVE-2013-5321.md): Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execu (no CVSS) - [CVE-2013-4653](https://cve.now/CVE-2013-4653.md): Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 86 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-08-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.