# CVEs published 2013-10-10 23 CVEs were published on October 10, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-0577](https://cve.now/CVE-2013-0577.md): The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to by (no CVSS) - [CVE-2013-0579](https://cve.now/CVE-2013-0579.md): The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote attackers to impersonate (no CVSS) - [CVE-2013-0580](https://cve.now/CVE-2013-0580.md): Cross-site request forgery (CSRF) vulnerability in the Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 (no CVSS) - [CVE-2013-3409](https://cve.now/CVE-2013-3409.md): The portal in Cisco Prime Central for Hosted Collaboration Solution (HCS) places cleartext credentials in temporary files, which allows loca (no CVSS) - [CVE-2013-4345](https://cve.now/CVE-2013-4345.md): Off-by-one error in the get\_prng\_bytes function in crypto/ansi\_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-depend (no CVSS) - [CVE-2013-4387](https://cve.now/CVE-2013-4387.md): net/ipv6/ip6\_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing (no CVSS) - [CVE-2013-4396](https://cve.now/CVE-2013-4396.md): Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remot (no CVSS) - [CVE-2013-5008](https://cve.now/CVE-2013-5008.md): The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup, as used in certain Altiris pr (no CVSS) - [CVE-2013-5499](https://cve.now/CVE-2013-5499.md): The remember feature in the DHCP server in Cisco IOS allows remote attackers to cause a denial of service (device reload) by acquiring a lea (no CVSS) - [CVE-2013-5523](https://cve.now/CVE-2013-5523.md): The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it (no CVSS) - [CVE-2013-5524](https://cve.now/CVE-2013-5524.md): Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote a (no CVSS) - [CVE-2013-5525](https://cve.now/CVE-2013-5525.md): SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users t (no CVSS) - [CVE-2013-5526](https://cve.now/CVE-2013-5526.md): Cisco 9900 fourth-generation IP phones do not properly perform SDP negotiation, which allows remote attackers to cause a denial of service ( (no CVSS) - [CVE-2013-5527](https://cve.now/CVE-2013-5527.md): The OSPF functionality in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted options in a (no CVSS) - [CVE-2013-1881](https://cve.now/CVE-2013-1881.md): GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in (no CVSS) - [CVE-2013-2138](https://cve.now/CVE-2013-2138.md): The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows (no CVSS) - [CVE-2013-2240](https://cve.now/CVE-2013-2240.md): lib/flowplayer.swf.php in Gallery 3 before 3.0.9 does not properly remove query fragments, which allows remote attackers to have an unspecif (no CVSS) - [CVE-2013-2241](https://cve.now/CVE-2013-2241.md): modules/gallery/helpers/data\_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain se (no CVSS) - [CVE-2013-4221](https://cve.now/CVE-2013-4221.md): The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Ja (no CVSS, org.restlet.jse:org.restlet) - [CVE-2013-4271](https://cve.now/CVE-2013-4271.md): The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allow (no CVSS, org.restlet.jse:org.restlet) - [CVE-2013-4342](https://cve.now/CVE-2013-4342.md): xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and m (no CVSS) - [CVE-2013-4351](https://cve.now/CVE-2013-4351.md): GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage p (no CVSS) - [CVE-2013-4767](https://cve.now/CVE-2013-4767.md): Unspecified vulnerability in Eucalyptus before 3.3.2 has unknown impact and attack vectors. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-10-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.