# CVEs published 2013-10-01

52 CVEs were published on October 1, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1892](https://cve.now/CVE-2013-1892.md): MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows r (no CVSS)
- [CVE-2013-2013](https://cve.now/CVE-2013-2013.md): The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows loc (no CVSS, python-keystoneclient)
- [CVE-2013-3969](https://cve.now/CVE-2013-3969.md): The find prototype in scripting/engine\_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (u (no CVSS)
- [CVE-2013-5975](https://cve.now/CVE-2013-5975.md): The access policy logon page (logon.inc) in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via (no CVSS)
- [CVE-2013-5976](https://cve.now/CVE-2013-5976.md): Cross-site scripting (XSS) vulnerability in the access policy logout page (logout.inc) in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 thr (no CVSS)
- [CVE-2013-3539](https://cve.now/CVE-2013-3539.md): Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC D (no CVSS)
- [CVE-2013-3688](https://cve.now/CVE-2013-3688.md): The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12\_sign6, does (no CVSS)
- [CVE-2013-3690](https://cve.now/CVE-2013-3690.md): Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040 (no CVSS)
- [CVE-2013-3962](https://cve.now/CVE-2013-3962.md): Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV36 (no CVSS)
- [CVE-2013-3963](https://cve.now/CVE-2013-3963.md): Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, G (no CVSS)
- [CVE-2013-3964](https://cve.now/CVE-2013-3964.md): Cross-site scripting (XSS) vulnerability in Samsung SHR-5162, SHR-5082, and possibly other models, allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-5580](https://cve.now/CVE-2013-5580.md): The (1) Conn\_StartLogin and (2) cb\_Read\_Resolver\_Result functions in conn.c in ngIRCd 18 through 20.2, when the configuration option NoticeA (no CVSS)
- [CVE-2011-2901](https://cve.now/CVE-2011-2901.md): Off-by-one error in the \_\_addr\_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (hos (no CVSS)
- [CVE-2012-2125](https://cve.now/CVE-2012-2125.md): RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during (no CVSS, rubygems-update)
- [CVE-2012-2126](https://cve.now/CVE-2012-2126.md): RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-th (no CVSS, rubygems-update)
- [CVE-2012-5627](https://cve.now/CVE-2012-5627.md): Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executio (no CVSS)
- [CVE-2013-2231](https://cve.now/CVE-2013-2231.md): Unquoted Windows search path vulnerability in the QEMU Guest Agent service for Red Hat Enterprise Linux Desktop 6, HPC Node 6, Server 6, Wor (no CVSS)
- [CVE-2013-2269](https://cve.now/CVE-2013-2269.md): The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7 (no CVSS)
- [CVE-2013-4210](https://cve.now/CVE-2013-4210.md): The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5 (no CVSS)
- [CVE-2013-4355](https://cve.now/CVE-2013-4355.md): Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) por (no CVSS)
- [CVE-2013-4361](https://cve.now/CVE-2013-4361.md): The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows l (no CVSS)
- [CVE-2013-4708](https://cve.now/CVE-2013-4708.md): The PPP Access Concentrator (PPPAC) in Internet Initiative Japan Inc. (no CVSS)
- [CVE-2013-5745](https://cve.now/CVE-2013-5745.md): The vino\_server\_client\_data\_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is d (no CVSS)
- [CVE-2012-3323](https://cve.now/CVE-2012-3323.md): IBM Maximo Asset Management 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3 allows remote attackers to gain privileges via uns (no CVSS)
- [CVE-2013-0451](https://cve.now/CVE-2013-0451.md): SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 through 7.1.1.12 allows remote authenticated users to e (no CVSS)
- [CVE-2013-3047](https://cve.now/CVE-2013-3047.md): IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified (no CVSS)
- [CVE-2013-3048](https://cve.now/CVE-2013-3048.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allo (no CVSS)
- [CVE-2013-3049](https://cve.now/CVE-2013-3049.md): IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrict (no CVSS)
- [CVE-2013-3971](https://cve.now/CVE-2013-3971.md): IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrict (no CVSS)
- [CVE-2013-3972](https://cve.now/CVE-2013-3972.md): IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via (no CVSS)
- [CVE-2013-3973](https://cve.now/CVE-2013-3973.md): SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to e (no CVSS)
- [CVE-2013-4013](https://cve.now/CVE-2013-4013.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.2 allows remote attackers to obtain sensitive info (no CVSS)
- [CVE-2013-4014](https://cve.now/CVE-2013-4014.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allow (no CVSS)
- [CVE-2013-4017](https://cve.now/CVE-2013-4017.md): SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2013-4018](https://cve.now/CVE-2013-4018.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensi (no CVSS)
- [CVE-2013-4019](https://cve.now/CVE-2013-4019.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 before 7.1.1.12 allows remote authenticate (no CVSS)
- [CVE-2013-4020](https://cve.now/CVE-2013-4020.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to bypass inte (no CVSS)
- [CVE-2013-4021](https://cve.now/CVE-2013-4021.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to conduct unsp (no CVSS)
- [CVE-2013-4027](https://cve.now/CVE-2013-4027.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to bypass inte (no CVSS)
- [CVE-2013-5380](https://cve.now/CVE-2013-5380.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows local users to obtain sensitive informatio (no CVSS)
- [CVE-2013-5381](https://cve.now/CVE-2013-5381.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to gain privil (no CVSS)
- [CVE-2013-5382](https://cve.now/CVE-2013-5382.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privile (no CVSS)
- [CVE-2013-5383](https://cve.now/CVE-2013-5383.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privile (no CVSS)
- [CVE-2013-5395](https://cve.now/CVE-2013-5395.md): IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to bypass intended access (no CVSS)
- [CVE-2013-3278](https://cve.now/CVE-2013-3278.md): EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password, which allows local users to obtain sens (no CVSS)
- [CVE-2013-4042](https://cve.now/CVE-2013-4042.md): Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arb (no CVSS)
- [CVE-2013-5370](https://cve.now/CVE-2013-5370.md): Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arb (no CVSS)
- [CVE-2013-5572](https://cve.now/CVE-2013-5572.md): Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ld (no CVSS)
- [CVE-2012-4096](https://cve.now/CVE-2012-4096.md): The local file editor in the Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privil (no CVSS)
- [CVE-2013-3041](https://cve.now/CVE-2013-3041.md): The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtai (no CVSS)
- [CVE-2013-5516](https://cve.now/CVE-2013-5516.md): The Media Snapshot implementation on Cisco TelePresence Multipoint Switch (CTMS) devices allows remote authenticated users to cause a denial (no CVSS)
- [CVE-2013-5725](https://cve.now/CVE-2013-5725.md): The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to ove (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.