# CVEs published 2013-09-25 22 CVEs were published on September 25, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-5586](https://cve.now/CVE-2013-5586.md): Cross-site scripting (XSS) vulnerability in wikka.php in WikkaWiki before 1.3.4-p1 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2013-5937](https://cve.now/CVE-2013-5937.md): Cross-site request forgery (CSRF) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the auth (no CVSS) - [CVE-2013-5938](https://cve.now/CVE-2013-5938.md): Cross-site scripting (XSS) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to inject arbitrary web s (no CVSS) - [CVE-2012-4086](https://cve.now/CVE-2012-4086.md): A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands (no CVSS) - [CVE-2013-1060](https://cve.now/CVE-2013-1060.md): A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13. (no CVSS) - [CVE-2013-2140](https://cve.now/CVE-2013-2140.md): The dispatch\_discard\_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 (no CVSS) - [CVE-2013-4022](https://cve.now/CVE-2013-4022.md): IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, (no CVSS) - [CVE-2013-4024](https://cve.now/CVE-2013-4024.md): IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, (no CVSS) - [CVE-2013-4025](https://cve.now/CVE-2013-4025.md): IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, (no CVSS) - [CVE-2013-4300](https://cve.now/CVE-2013-4300.md): The scm\_check\_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which (no CVSS) - [CVE-2013-4343](https://cve.now/CVE-2013-4343.md): Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the (no CVSS) - [CVE-2013-4350](https://cve.now/CVE-2013-4350.md): The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigg (no CVSS) - [CVE-2013-4777](https://cve.now/CVE-2013-4777.md): A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init\_runit so (no CVSS) - [CVE-2013-5118](https://cve.now/CVE-2013-5118.md): Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attackers to inject arbitrar (no CVSS) - [CVE-2013-5200](https://cve.now/CVE-2013-5200.md): The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2 (no CVSS) - [CVE-2013-5373](https://cve.now/CVE-2013-5373.md): The RemoteClient component in IBM Rational ClearCase 8.0.0.03 through 8.0.0.07, and 8.0.1, uses world-writable permissions for the rcleartoo (no CVSS) - [CVE-2013-5634](https://cve.now/CVE-2013-5634.md): arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (no CVSS) - [CVE-2013-5750](https://cve.now/CVE-2013-5750.md): The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (C (no CVSS, friendsofsymfony/user-bundle) - [CVE-2013-5933](https://cve.now/CVE-2013-5933.md): Stack-based buffer overflow in the sub\_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for R (no CVSS) - [CVE-2013-5934](https://cve.now/CVE-2013-5934.md): Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows (no CVSS) - [CVE-2013-5935](https://cve.now/CVE-2013-5935.md): The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set (no CVSS) - [CVE-2013-5936](https://cve.now/CVE-2013-5936.md): The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain s (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-09-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.