# CVEs published 2013-09-30

38 CVEs were published on September 30, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2218](https://cve.now/CVE-2013-2218.md): Double free vulnerability in the virConnectListAllInterfaces method in interface/interface\_backend\_netcf.c in libvirt 1.0.6 allows remote at (no CVSS)
- [CVE-2013-2230](https://cve.now/CVE-2013-2230.md): The qemu driver (qemu/qemu\_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) v (no CVSS)
- [CVE-2013-4153](https://cve.now/CVE-2013-4153.md): Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu\_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to c (no CVSS)
- [CVE-2013-4154](https://cve.now/CVE-2013-4154.md): The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2013-4239](https://cve.now/CVE-2013-4239.md): The xenDaemonListDefinedDomains function in xen/xend\_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of serv (no CVSS)
- [CVE-2013-4291](https://cve.now/CVE-2013-4291.md): The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not (no CVSS)
- [CVE-2013-4292](https://cve.now/CVE-2013-4292.md): libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters (no CVSS)
- [CVE-2013-4296](https://cve.now/CVE-2013-4296.md): The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1. (no CVSS)
- [CVE-2013-4297](https://cve.now/CVE-2013-4297.md): The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of (no CVSS)
- [CVE-2013-4310](https://cve.now/CVE-2013-4310.md): Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix. (no CVSS, org.apache.struts:struts2-core)
- [CVE-2013-4314](https://cve.now/CVE-2013-4314.md): The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name fiel (no CVSS, pyopenssl)
- [CVE-2013-4316](https://cve.now/CVE-2013-4316.md): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. (no CVSS, org.apache.struts:struts2-core · org.apache.struts:struts2-…)
- [CVE-2013-5651](https://cve.now/CVE-2013-5651.md): The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out (no CVSS)
- [CVE-2013-5697](https://cve.now/CVE-2013-5697.md): SQL injection vulnerability in mod\_accounting.c in the mod\_accounting module 0.5 and earlier for Apache allows remote attackers to execute a (no CVSS)
- [CVE-2013-0211](https://cve.now/CVE-2013-0211.md): Integer signedness error in the archive\_write\_zip\_data function in archive\_write\_set\_format\_zip.c in libarchive 3.1.2 and earlier, when runn (no CVSS)
- [CVE-2013-1444](https://cve.now/CVE-2013-1444.md): A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files v (no CVSS)
- [CVE-2013-1839](https://cve.now/CVE-2013-1839.md): The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a den (no CVSS)
- [CVE-2013-2238](https://cve.now/CVE-2013-2238.md): Multiple buffer overflows in the switch\_perform\_substitution function in switch\_regex.c in FreeSWITCH 1.2 allow remote attackers to cause a (no CVSS)
- [CVE-2013-4222](https://cve.now/CVE-2013-4222.md): OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a t (no CVSS)
- [CVE-2013-4362](https://cve.now/CVE-2013-4362.md): WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel\_interface.c (no CVSS)
- [CVE-2013-4623](https://cve.now/CVE-2013-4623.md): The x509parse\_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages duri (no CVSS)
- [CVE-2013-5692](https://cve.now/CVE-2013-5692.md): Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary l (no CVSS)
- [CVE-2013-5693](https://cve.now/CVE-2013-5693.md): Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2013-1442](https://cve.now/CVE-2013-1442.md): Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTO (no CVSS)
- [CVE-2013-4136](https://cve.now/CVE-2013-4136.md): ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the o (no CVSS, passenger)
- [CVE-2013-4359](https://cve.now/CVE-2013-4359.md): Integer overflow in kbdint.c in mod\_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumpt (no CVSS)
- [CVE-2013-4372](https://cve.now/CVE-2013-4372.md): Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0 (no CVSS)
- [CVE-2013-5964](https://cve.now/CVE-2013-5964.md): Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authe (no CVSS)
- [CVE-2013-5965](https://cve.now/CVE-2013-5965.md): The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hook\_query\_alter function, which might al (no CVSS)
- [CVE-2013-4378](https://cve.now/CVE-2013-4378.md): Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inj (no CVSS, net.bull.javamelody:javamelody-core)
- [CVE-2013-5961](https://cve.now/CVE-2013-5961.md): Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2013-5962](https://cve.now/CVE-2013-5962.md): Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPres (no CVSS)
- [CVE-2013-5963](https://cve.now/CVE-2013-5963.md): Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to (no CVSS)
- [CVE-2013-3417](https://cve.now/CVE-2013-3417.md): The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remot (no CVSS)
- [CVE-2013-5504](https://cve.now/CVE-2013-5504.md): Cross-site scripting (XSS) vulnerability in the Mobile Device Management (MDM) portal in Cisco Identity Services Engine (ISE) allows remote (no CVSS)
- [CVE-2013-5505](https://cve.now/CVE-2013-5505.md): Cross-site scripting (XSS) vulnerability in an administration page in Cisco Identity Services Engine (ISE) allows remote attackers to inject (no CVSS)
- [CVE-2013-5679](https://cve.now/CVE-2013-5679.md): The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x be (no CVSS, org.owasp.esapi:esapi)
- [CVE-2013-5960](https://cve.now/CVE-2013-5960.md): The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x be (no CVSS, org.owasp.esapi:esapi)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.