# CVEs published 2013-09-16

42 CVEs were published on September 16, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1439](https://cve.now/CVE-2013-1439.md): The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of servic (no CVSS)
- [CVE-2013-1441](https://cve.now/CVE-2013-1441.md): econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a d (no CVSS)
- [CVE-2013-2256](https://cve.now/CVE-2013-2256.md): OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is\_public property, which (no CVSS, nova)
- [CVE-2013-4123](https://cve.now/CVE-2013-4123.md): client\_side\_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafte (no CVSS)
- [CVE-2013-4132](https://cve.now/CVE-2013-4132.md): KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw\_encrypt functions, which allows re (no CVSS)
- [CVE-2013-4179](https://cve.now/CVE-2013-4179.md): The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to ca (no CVSS, nova)
- [CVE-2013-4180](https://cve.now/CVE-2013-4180.md): The (1) power and (2) ipmi\_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (m (no CVSS)
- [CVE-2013-4181](https://cve.now/CVE-2013-4181.md): Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virt (no CVSS)
- [CVE-2013-4182](https://cve.now/CVE-2013-4182.md): app/controllers/api/v1/hosts\_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers (no CVSS)
- [CVE-2013-4183](https://cve.now/CVE-2013-4183.md): The clear\_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting (no CVSS, cinder)
- [CVE-2013-4202](https://cve.now/CVE-2013-4202.md): The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume\_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and e (no CVSS, cinder)
- [CVE-2013-4233](https://cve.now/CVE-2013-4233.md): Integer overflow in the abc\_set\_parts function in load\_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial o (no CVSS)
- [CVE-2013-4234](https://cve.now/CVE-2013-4234.md): Multiple heap-based buffer overflows in the (1) abc\_MIDI\_drum and (2) abc\_MIDI\_gchord functions in load\_abc.cpp in libmodplug 0.8.8.4 and ea (no CVSS)
- [CVE-2013-4259](https://cve.now/CVE-2013-4259.md): runner/connection\_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a syml (no CVSS, ansible)
- [CVE-2013-4260](https://cve.now/CVE-2013-4260.md): lib/ansible/playbook/\_\_init\_\_.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite (no CVSS, ansible)
- [CVE-2013-4277](https://cve.now/CVE-2013-4277.md): Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary (no CVSS)
- [CVE-2013-4278](https://cve.now/CVE-2013-4278.md): The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is\_publi (no CVSS, nova)
- [CVE-2013-4315](https://cve.now/CVE-2013-4315.md): Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to r (no CVSS, django)
- [CVE-2013-5650](https://cve.now/CVE-2013-5650.md): Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access C (no CVSS)
- [CVE-2013-5751](https://cve.now/CVE-2013-5751.md): Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2013-4047](https://cve.now/CVE-2013-4047.md): Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 a (no CVSS)
- [CVE-2013-4048](https://cve.now/CVE-2013-4048.md): Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 a (no CVSS)
- [CVE-2013-4049](https://cve.now/CVE-2013-4049.md): Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 all (no CVSS)
- [CVE-2013-5369](https://cve.now/CVE-2013-5369.md): IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbit (no CVSS)
- [CVE-2012-6087](https://cve.now/CVE-2012-6087.md): repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does (no CVSS)
- [CVE-2013-4313](https://cve.now/CVE-2013-4313.md): Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strin (no CVSS)
- [CVE-2013-4341](https://cve.now/CVE-2013-4341.md): Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 (no CVSS)
- [CVE-2013-5674](https://cve.now/CVE-2013-5674.md): badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external b (no CVSS)
- [CVE-2013-1025](https://cve.now/CVE-2013-1025.md): Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of servi (no CVSS)
- [CVE-2013-1026](https://cve.now/CVE-2013-1026.md): Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (a (no CVSS)
- [CVE-2013-1027](https://cve.now/CVE-2013-1027.md): Installer in Apple Mac OS X before 10.8.5 provides an option to continue a package's installation after encountering a revoked certificate, (no CVSS)
- [CVE-2013-1028](https://cve.now/CVE-2013-1028.md): The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateway (no CVSS)
- [CVE-2013-1029](https://cve.now/CVE-2013-1029.md): The kernel in Apple Mac OS X before 10.8.5 allows remote attackers to cause a denial of service (panic) via crafted IGMP packets that levera (no CVSS)
- [CVE-2013-1030](https://cve.now/CVE-2013-1030.md): mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line, which allows local users to obt (no CVSS)
- [CVE-2013-1031](https://cve.now/CVE-2013-1031.md): Power Management in Apple Mac OS X before 10.8.5 does not properly perform locking upon occurrences of a power assertion, which allows physi (no CVSS)
- [CVE-2013-1032](https://cve.now/CVE-2013-1032.md): QuickTime in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption (no CVSS)
- [CVE-2013-1033](https://cve.now/CVE-2013-1033.md): Screen Lock in Apple Mac OS X before 10.8.5 does not properly track sessions, which allows remote authenticated users to bypass locking by l (no CVSS)
- [CVE-2013-1824](https://cve.now/CVE-2013-1824.md): The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing (no CVSS)
- [CVE-2013-4704](https://cve.now/CVE-2013-4704.md): Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-5494](https://cve.now/CVE-2013-5494.md): Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified MeetingPlace Solution, as used in Unified MeetingPlace (no CVSS)
- [CVE-2013-5495](https://cve.now/CVE-2013-5495.md): Cross-site scripting (XSS) vulnerability in the web framework in the Application Server in Cisco Unified MeetingPlace allows remote attacker (no CVSS)
- [CVE-2013-5496](https://cve.now/CVE-2013-5496.md): Open Network Environment Platform (ONEP) in Cisco NX-OS allows remote authenticated users to cause a denial of service (network-element relo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-09-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.