# CVEs published 2013-10-11 24 CVEs were published on October 11, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2007-6755](https://cve.now/CVE-2007-6755.md): The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual\_EC\_DRBG) algorithm contains point (no CVSS) - [CVE-2009-5136](https://cve.now/CVE-2009-5136.md): The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT\_SUSPEND policy that evaluate to an UNDE (no CVSS) - [CVE-2013-3693](https://cve.now/CVE-2013-3693.md): The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the (no CVSS) - [CVE-2013-4137](https://cve.now/CVE-2013-4137.md): Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2013-4167](https://cve.now/CVE-2013-4167.md): Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2013-4173](https://cve.now/CVE-2013-4173.md): Directory traversal vulnerability in the trend-data daemon (xymond\_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitra (no CVSS) - [CVE-2013-4203](https://cve.now/CVE-2013-4203.md): The self.run\_gpg function in lib/rgpg/gpg\_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary comma (no CVSS, rgpg) - [CVE-2013-4255](https://cve.now/CVE-2013-4255.md): The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) C (no CVSS) - [CVE-2013-4319](https://cve.now/CVE-2013-4319.md): pbs\_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict (no CVSS) - [CVE-2013-4377](https://cve.now/CVE-2013-4377.md): Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (d (no CVSS) - [CVE-2013-4388](https://cve.now/CVE-2013-4388.md): Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers t (no CVSS) - [CVE-2013-6079](https://cve.now/CVE-2013-6079.md): Buffer overflow in MostGear Soft Easy LAN Folder Share 3.2.0.100 allows local users to cause a denial of service (application crash) and pos (no CVSS) - [CVE-2013-2578](https://cve.now/CVE-2013-2578.md): cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware L (no CVSS) - [CVE-2013-2579](https://cve.now/CVE-2013-2579.md): TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12\_sign6 have an e (no CVSS) - [CVE-2013-2580](https://cve.now/CVE-2013-2580.md): Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibl (no CVSS) - [CVE-2013-2581](https://cve.now/CVE-2013-2581.md): cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware L (no CVSS) - [CVE-2013-3686](https://cve.now/CVE-2013-3686.md): cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password vi (no CVSS) - [CVE-2013-3687](https://cve.now/CVE-2013-3687.md): AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sen (no CVSS) - [CVE-2013-4305](https://cve.now/CVE-2013-4305.md): Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded (no CVSS) - [CVE-2013-4306](https://cve.now/CVE-2013-4306.md): Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser be (no CVSS) - [CVE-2013-5028](https://cve.now/CVE-2013-5028.md): SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to exe (no CVSS) - [CVE-2013-5528](https://cve.now/CVE-2013-5528.md): Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authentic (no CVSS) - [CVE-2013-5532](https://cve.now/CVE-2013-5532.md): Buffer overflow in the web-application interface on Cisco 9900 IP phones allows remote attackers to cause a denial of service (webapp interf (no CVSS) - [CVE-2013-5533](https://cve.now/CVE-2013-5533.md): The image-upgrade functionality on Cisco 9900 Unified IP phones allows local users to gain privileges by placing shell commands in an unspec (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-10-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.