# CVEs published 2013-08-28

34 CVEs were published on August 28, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2035](https://cve.now/CVE-2013-2035.md): Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library pat (no CVSS, org.fusesource.hawtjni:hawtjni-runtime)
- [CVE-2013-2178](https://cve.now/CVE-2013-2178.md): The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly va (no CVSS)
- [CVE-2013-5018](https://cve.now/CVE-2013-5018.md): The is\_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1\_length function, which allow (no CVSS)
- [CVE-2013-1432](https://cve.now/CVE-2013-1432.md): Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which al (no CVSS)
- [CVE-2013-2072](https://cve.now/CVE-2013-2072.md): Buffer overflow in the Python bindings for the xc\_vcpu\_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with perm (no CVSS)
- [CVE-2013-2076](https://cve.now/CVE-2013-2076.md): Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when (no CVSS)
- [CVE-2013-2077](https://cve.now/CVE-2013-2077.md): Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of serv (no CVSS)
- [CVE-2013-2176](https://cve.now/CVE-2013-2176.md): Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) in the rhev-gue (no CVSS)
- [CVE-2013-2211](https://cve.now/CVE-2013-2211.md): The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emu (no CVSS)
- [CVE-2013-2212](https://cve.now/CVE-2013-2212.md): The vmx\_set\_uc\_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions (no CVSS)
- [CVE-2013-3495](https://cve.now/CVE-2013-3495.md): The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a m (no CVSS)
- [CVE-2013-4111](https://cve.now/CVE-2013-4111.md): The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify\_ok value, which prevents the (no CVSS, python-glanceclient)
- [CVE-2013-2123](https://cve.now/CVE-2013-2123.md): The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to con (no CVSS)
- [CVE-2013-2197](https://cve.now/CVE-2013-2197.md): The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal, when using the login delay option, allows remote att (no CVSS)
- [CVE-2013-2247](https://cve.now/CVE-2013-2247.md): The Fast Permissions Administration module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to (no CVSS)
- [CVE-2013-4138](https://cve.now/CVE-2013-4138.md): Cross-site scripting (XSS) vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the "Ad (no CVSS)
- [CVE-2013-4139](https://cve.now/CVE-2013-4139.md): The Stage File Proxy module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to cause a denial of service (file operations performa (no CVSS)
- [CVE-2013-4272](https://cve.now/CVE-2013-4272.md): The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging (no CVSS)
- [CVE-2013-4274](https://cve.now/CVE-2013-4274.md): Cross-site scripting (XSS) vulnerability in the password\_policy\_admin\_view function in password\_policy.admin.inc in the Password Policy modu (no CVSS)
- [CVE-2013-2353](https://cve.now/CVE-2013-2353.md): Unspecified vulnerability in HP StoreOnce D2D Backup System 1.x before 1.2.19 and 2.x before 2.3.0 allows remote attackers to cause a denial (no CVSS)
- [CVE-2013-3077](https://cve.now/CVE-2013-3077.md): Multiple integer overflows in the IP\_MSFILTER and IPV6\_MSFILTER features in (1) sys/netinet/in\_mcast.c and (2) sys/netinet6/in6\_mcast.c in t (no CVSS)
- [CVE-2013-3271](https://cve.now/CVE-2013-3271.md): EMC RSA Authentication Agent for PAM 7.0 before 7.0.2.1 enforces the maximum number of login attempts within the PAM-enabled application cod (no CVSS)
- [CVE-2013-3582](https://cve.now/CVE-2013-3582.md): Buffer overflow in Dell BIOS on Dell Latitude D###, E####, XT2, and Z600 devices, and Dell Precision M#### devices, allows local users to by (no CVSS)
- [CVE-2013-4033](https://cve.now/CVE-2013-4033.md): IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute (no CVSS)
- [CVE-2013-4039](https://cve.now/CVE-2013-4039.md): IBM WebSphere Extended Deployment Compute Grid 8.0 before 8.0.0.3 allows remote authenticated users to obtain sensitive information, and con (no CVSS)
- [CVE-2013-2782](https://cve.now/CVE-2013-2782.md): Schneider Electric Trio J-Series License Free Ethernet Radio with firmware 3.6.0 through 3.6.3 uses the same AES encryption key across diffe (no CVSS)
- [CVE-2013-2804](https://cve.now/CVE-2013-2804.md): The DNP Master Driver in Software Toolbox TOP Server before 5.12.140.0 allows remote attackers to cause a denial of service (master-station (no CVSS)
- [CVE-2013-3583](https://cve.now/CVE-2013-3583.md): Cross-site request forgery (CSRF) vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authent (no CVSS)
- [CVE-2013-3584](https://cve.now/CVE-2013-3584.md): Cross-site scripting (XSS) vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the cust (no CVSS)
- [CVE-2013-3585](https://cve.now/CVE-2013-3585.md): Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive inf (no CVSS)
- [CVE-2013-3586](https://cve.now/CVE-2013-3586.md): Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie. (no CVSS)
- [CVE-2013-3590](https://cve.now/CVE-2013-3590.md): Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2013-3597](https://cve.now/CVE-2013-3597.md): servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action. (no CVSS)
- [CVE-2013-3598](https://cve.now/CVE-2013-3598.md): Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arb (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.