# CVEs published 2013-10-03 27 CVEs were published on October 3, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-0742](https://cve.now/CVE-2013-0742.md): Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (applica (no CVSS) - [CVE-2013-3248](https://cve.now/CVE-2013-3248.md): Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in t (no CVSS) - [CVE-2013-1061](https://cve.now/CVE-2013-1061.md): dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not (no CVSS) - [CVE-2013-1062](https://cve.now/CVE-2013-1062.md): ubuntu-system-service 0.2.4 before 0.2.4.1. (no CVSS) - [CVE-2013-1063](https://cve.now/CVE-2013-1063.md): usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication wi (no CVSS) - [CVE-2013-1064](https://cve.now/CVE-2013-1064.md): apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authorit (no CVSS) - [CVE-2013-1065](https://cve.now/CVE-2013-1065.md): backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local user (no CVSS) - [CVE-2013-1066](https://cve.now/CVE-2013-1066.md): language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with (no CVSS) - [CVE-2013-4288](https://cve.now/CVE-2013-4288.md): Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setu (no CVSS) - [CVE-2013-4311](https://cve.now/CVE-2013-4311.md): libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrict (no CVSS) - [CVE-2013-4324](https://cve.now/CVE-2013-4324.md): spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit\_unix\_process\_new API function, which all (no CVSS) - [CVE-2013-4326](https://cve.now/CVE-2013-4326.md): RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intend (no CVSS) - [CVE-2013-4327](https://cve.now/CVE-2013-4327.md): systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictio (no CVSS) - [CVE-2013-5701](https://cve.now/CVE-2013-5701.md): Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbser (no CVSS) - [CVE-2013-6010](https://cve.now/CVE-2013-6010.md): Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2013-5690](https://cve.now/CVE-2013-5690.md): Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitra (no CVSS) - [CVE-2013-6009](https://cve.now/CVE-2013-6009.md): CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject (no CVSS) - [CVE-2012-4136](https://cve.now/CVE-2012-4136.md): The high-availability service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) does not properly bind the cluste (no CVSS) - [CVE-2013-0689](https://cve.now/CVE-2013-0689.md): The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and (no CVSS) - [CVE-2013-0692](https://cve.now/CVE-2013-0692.md): The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlie (no CVSS) - [CVE-2013-0693](https://cve.now/CVE-2013-0693.md): The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlie (no CVSS) - [CVE-2013-0694](https://cve.now/CVE-2013-0694.md): The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with so (no CVSS) - [CVE-2013-3593](https://cve.now/CVE-2013-3593.md): Baramundi Management Suite 7.5 through 8.9 uses cleartext for (1) client-server communication and (2) data storage, which allows remote atta (no CVSS) - [CVE-2013-3624](https://cve.now/CVE-2013-3624.md): The OS deployment feature in Baramundi Management Suite 7.5 through 8.9 stores credentials in cleartext on deployed machines, which allows r (no CVSS) - [CVE-2013-3625](https://cve.now/CVE-2013-3625.md): An unspecified DLL file in Baramundi Management Suite 7.5 through 8.9 uses a hardcoded encryption key, which makes it easier for attackers t (no CVSS) - [CVE-2013-5519](https://cve.now/CVE-2013-5519.md): Cross-site scripting (XSS) vulnerability in the management interface on Cisco Wireless LAN Controller (WLC) devices allows remote attackers (no CVSS) - [CVE-2013-5944](https://cve.now/CVE-2013-5944.md): The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 doe (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-10-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.